CVE-2026-28197: Privilege Escalation via Argument Injection in NetBackup Flex OS Shell
An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions. Successful exploitation grants the attacker unrestricted control over the Flex appliance host and all hosted containers, fully compromising confidentiality, integrity, and availability.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
NetBackup Flex OS deployments are exposed where a low-privileged authenticated user has access to the management shell and can invoke the affected privileged administrative command.
What access does an attacker need?
An attacker needs valid authenticated access as a low-privileged user to the NetBackup Flex OS management shell. No user interaction is required after that access is obtained.
What is the impact of successful exploitation?
Successful exploitation executes arbitrary code with root-level permissions on the Flex appliance host. This gives the attacker unrestricted control of the host and all hosted containers, compromising confidentiality, integrity, and availability.