CVE-2026-108925: Cohesity - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web interface.
This issue affects NetBackup Administration Console web interface: versions before 11.2.
https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0002.md
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cohesity NetBackup Administration Consoleto a version that resolves this vulnerability.Fixed in 11.2
Event History
Frequently Asked Questions
Which deployments are affected?
The affected component is the Cohesity NetBackup Administration Console web interface in versions before 11.2. Version 11.2 and later are not identified as affected by the provided advisory data.
Does exploitation require authentication or user interaction?
The supplied CVSS vector indicates that an attacker does not need privileges, but exploitation requires user interaction. The attack can be conducted over the network with low attack complexity.
What impact could successful exploitation have?
The CVSS vector indicates low confidentiality and integrity impact, with no availability impact. It also indicates scope change, meaning the impact may extend beyond the initially vulnerable component.