CVE-2026-28199: NetBackup Flex OS Path Traversal Flaw

CVE-2026-28199 Overview

CVE-2026-28199 is an arbitrary file read vulnerability in the NetBackup Flex OS management shell. An authenticated user with shell access can supply a specially crafted path argument to a diagnostic command and read arbitrary files from the underlying operating system. Successful exploitation exposes sensitive system configuration and credential material stored on the appliance.

The vulnerability is tracked under [CWE-347] and requires local access with low privileges. No public exploit is currently available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Authenticated attackers can exfiltrate configuration files, secrets, and credentials from NetBackup Flex appliances, enabling downstream lateral movement into the backup infrastructure.

Affected Products

NetBackup Flex OS management shell (see GitHub Security Advisory COH-2026-0001 for affected versions)
Cohesity NetBackup Flex appliances exposing the diagnostic command interface
Deployments where administrators or operators hold shell-level accounts

Discovery Timeline

2026-09-18 - CVE-2026-28199 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-28199

Vulnerability Analysis

The flaw resides in a diagnostic command exposed through the NetBackup Flex OS management shell. The command accepts a path argument that is passed to file-read logic without sufficient validation. An authenticated shell user can substitute the intended diagnostic target with an arbitrary absolute path or a traversal sequence, and the process returns the file contents through the shell interface.

Because the shell process runs with elevated privileges on the appliance, the read primitive is not restricted to files owned by the calling user. This allows retrieval of protected files such as /etc/shadow, service credential stores, TLS private keys, and NetBackup configuration data. Exposure of credential material typically enables follow-on compromise of the backup fabric and any systems that trust it.

The issue is scored as a local, low-complexity attack requiring low privileges and no user interaction. It affects confidentiality only, with no direct integrity or availability impact.

Root Cause

The root cause is missing or insufficient input validation on the path argument accepted by a diagnostic command in the Flex OS management shell. The command trusts caller-supplied paths and does not enforce a canonicalization or allow-list check before opening the target file. The [CWE-347] mapping in the NVD entry reflects the vendor's classification tied to how the diagnostic input is authenticated and processed.

Attack Vector

Exploitation requires an authenticated session on the Flex OS management shell. The attacker invokes the vulnerable diagnostic command and supplies a path pointing to a sensitive file, such as an appliance configuration store or a credential file. The command returns the file's contents to the attacker's shell session, from which they can stage the data for exfiltration. See the Cohesity security advisory and the CVCN CVE-2026-28199 detail page for vendor-specific reproduction context.

Detection Methods for CVE-2026-28199

Indicators of Compromise

Diagnostic command invocations in Flex OS shell audit logs referencing paths outside expected diagnostic directories, such as /etc/, /root/, or NetBackup credential paths.
Repeated diagnostic command executions from a single operator account within a short window.
Shell sessions that read sensitive files followed by outbound data transfer or archive creation on the appliance.

Detection Strategies

Baseline normal diagnostic command usage per operator, then alert on path arguments containing .., absolute paths outside the diagnostic scope, or references to credential and key files.
Correlate shell command audit events with subsequent network egress or file staging on the appliance.
Review privileged-account activity on Flex OS appliances for out-of-hours or first-time diagnostic command usage.

Monitoring Recommendations

Forward Flex OS shell audit logs and NetBackup appliance telemetry to a centralized SIEM for retention and correlation.
Enable alerting on any read access to /etc/shadow, TLS key stores, and NetBackup credential files performed through management-shell processes.
Track authentication events for management-shell accounts and flag credential reuse from unusual source addresses.

How to Mitigate CVE-2026-28199

Immediate Actions Required

Apply the vendor patch referenced in Cohesity advisory COH-2026-0001 as soon as it is available for your Flex OS release train.
Restrict management-shell access to a minimal set of named administrator accounts and disable shared operator accounts.
Rotate credentials, API keys, and TLS material stored on affected appliances if shell access has been broadly available.

Patch Information

Refer to the vendor advisory at GitHub Security Advisory COH-2026-0001 for fixed versions and upgrade procedures. The CVCN entry at CVE-2026-28199 Detail by CVCN mirrors the vendor guidance for regulated environments in Italy.

Workarounds

Limit network reachability of the Flex OS management shell to a dedicated administrative jump host or bastion.
Enforce multi-factor authentication for all management-shell accounts to reduce the risk of credential-based abuse.
Enable and review command-level audit logging on the appliance so that diagnostic command misuse is detectable prior to patch deployment.

bash

# Configuration example: restrict management-shell access at the network layer
# Replace <mgmt_ip> with the appliance management interface and <bastion_cidr> with the admin bastion range
iptables -A INPUT -p tcp --dport 22 -s <bastion_cidr> -d <mgmt_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -d <mgmt_ip> -j DROP