Authenticated attackers can achieve full system compromise on Cohesity TranZman 4 appliances via OS command injection vulnerabilities in the web application API.

The appliance fails to sanitize user-controlled parameters within the Scheduler and Actions API endpoints, leading to OS command injection. An authenticated administrator can inject shell metacharacters to execute arbitrary commands as the root user, bypassing intended shell restrictions.

Successful exploitation leads to a total compromise of the affected appliance, allowing an attacker to gain root-level access to the system. Given the CVSS score of 7.2, this vulnerability poses a significant risk to data confidentiality, integrity, and availability, potentially allowing attackers to pivot into the broader network environment.

Immediate Action: Contact Cohesity support immediately to obtain the latest security patches or guidance for mitigating these command injection flaws.

Proactive Monitoring: Review web application access logs for anomalous requests to Scheduler or Actions endpoints containing shell metacharacters such as semicolons, pipes, or backticks.

Compensating Controls: Restrict administrative access to the TranZman web interface to known, trusted management workstations and deploy a Web Application Firewall to inspect and block malicious payload patterns in API requests.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository referenced in the CVE record.

The severity of this vulnerability, combined with the availability of public proof-of-concept material, necessitates immediate action. Administrators must verify their current build versions and implement the aforementioned access controls while coordinating with the vendor for a permanent patch to prevent full system compromise.