A critical argument injection vulnerability in Cohesity NetBackup Flex OS allows authenticated, low-privileged users to escalate privileges to root, resulting in full system compromise.

This flaw involves CWE-88, where improper neutralization of argument delimiters in the management shell allows a low-privileged user to inject malicious input into privileged administrative commands. Successful exploitation enables the execution of arbitrary commands with full root-level permissions on the appliance host.

The potential for unauthorized root-level code execution poses a catastrophic risk to organizational infrastructure. An attacker gaining this level of access can achieve total control over the Flex appliance and all hosted containers, leading to complete loss of data confidentiality, integrity, and availability. With a CVSS score of 8.8, this vulnerability is classified as high severity, reflecting the significant impact on both security posture and operational continuity.

Immediate Action: Update Cohesity NetBackup Flex OS to version 6.4 or later immediately to apply the vendor-supplied security patch.

Proactive Monitoring: Review management shell access logs for anomalous command execution patterns or unauthorized attempts to access privileged administrative functions.

Compensating Controls: Restrict access to the management shell to only essential personnel using principle of least privilege, and ensure that all administrative sessions are monitored through an audited terminal access solution.

Public Exploit Available: exploit_available (false)

Given the ability of a low-privileged user to obtain full system control, organizations must treat this vulnerability with high urgency. Administrators should prioritize the deployment of the 6.4 update across all affected NetBackup Flex OS instances to eliminate the argument injection vector. Failure to patch this vulnerability leaves the appliance susceptible to complete takeover by any authenticated user with shell access.