CVE-2026-60039: Command injection in backup restore
Published Nov 10, 2026
·Updated
A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code execution. This can result in a total loss of confidentiality, integrity and availability.
Event History
Nov 10, 2026
CVE Published
via MITRE·08:36 AM
Data Sourced
via MITRE·08:36 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require victim interaction?
No. The CVSS vector indicates that no user interaction is required.
2
Can exploitation affect components outside the vulnerable security authority?
No. The CVSS vector lists scope as unchanged, indicating the impact is assessed within the same security authority.