Backup infrastructure is now a front-line security asset. When attackers go after an organisation, the backup console and the appliances behind it are high on their list, because whoever controls recovery controls the outcome. That is why two recent Cohesity security advisories for NetBackup deserve attention from every GCC organisation that runs it.

What happened

On 11 October 2026, a CVE record, CVE-2026-108925, was published for the NetBackup Administration Console web interface. It corresponds to Cohesity advisory COH-2026-0002, first issued on 28 August 2026.

What it is: an HTML injection (cross-site scripting) weakness. User-supplied input is not sufficiently sanitised, so attacker-supplied content can render inside an administrator's trusted console session.
Severity: Medium (CVSS v3.1 6.1). An attacker has to persuade an authenticated administrator to open a specially crafted link.
Realistic impact: convincing phishing inside the admin interface, redirection to attacker-controlled pages, or a visually manipulated console.
Affected: NetBackup versions before 11.2, including NetBackup Flex Appliances running NetBackup before 11.2.
Fix: upgrade to NetBackup 11.2 or later. Cohesity states that no configuration change fully removes the risk.

It follows an earlier and more serious advisory, COH-2026-0001 (first issued 21 July 2026), for NetBackup Flex OS:

CVE-2026-28197 and CVE-2026-28198: privilege escalation (argument injection, and a signature-verification bypass) that can let an authenticated, low-privileged user of the management shell run code as root. Rated High under CVSS v3.1 (8.8) and Critical under CVSS v4.0 (9.4).
CVE-2026-28199: a lower-severity path traversal that lets an authenticated shell user read operating-system files, which can expose configuration and credential material.
Affected: all Flex OS versions before 6.4. Fix: Flex OS 6.4 or later.

Both issues were reported responsibly to Cohesity, and fixed releases are available.

What this means for GCC customers

In our work with banks, government entities and large enterprises across the UAE and the wider GCC, we see the same pattern again and again: backup platforms are upgraded far less often than the systems they protect. Change windows are tight, appliances "just work", and nobody wants to touch the recovery layer before a quarter-end or an audit. The result is that the most trusted system in the data centre is often several releases behind.

These advisories change that calculation:

Recovery is your last line of defence. Root-level control of a Flex appliance is not just an IT incident. It puts protected copies at risk at the moment you need them most.
Auditors will ask. Regulated organisations in the region are expected to remediate known vulnerabilities in good time and to show evidence that they did. A documented NetBackup upgrade plan is exactly that kind of evidence.
Insider and credential risk is real. The Flex OS issues need an authenticated shell user. In environments with shared service accounts, outsourced operations or broad admin access, "low-privileged" is not the same as "trusted".
Phishing has moved into the console. The console issue targets your most privileged people. Backup administrators hold the keys to recovery, which makes them an attractive target.

The good news: both issues have clear fixes, and a well-prepared upgrade is a routine, low-risk activity.

Practical recommendations

Inventory your estate. List every NetBackup primary and media server, every Flex Appliance and its Flex OS version, and the NetBackup version running on each.
Prioritise Flex OS 6.4. If you run Flex Appliances below 6.4, make this the first priority, given the Critical CVSS v4.0 rating.
Plan NetBackup 11.2. Check compatibility with your clients, agents, operating systems and any integrated archive or replication targets before scheduling the change.
Apply interim controls now. Restrict management-shell and console access to authorised administrators on trusted network segments, review who holds shell accounts, and remind admins not to open unsolicited links to the console.
Test recovery after upgrading. An upgrade is only proven by a successful restore. Run a recovery test and keep the evidence for your auditors.
Document everything. Record versions before and after, change approvals and test results. This turns a patch into compliance evidence.

FAQ

Are we affected if we only use the NetBackup web console occasionally?

Yes, if you run NetBackup earlier than 11.2. The console issue depends on an administrator opening a crafted link, not on how often the console is used. Restrict access in the meantime and plan the upgrade.

Does the Flex OS issue apply to every NetBackup customer?

No. The Flex OS advisory applies to NetBackup Flex Appliances running Flex OS earlier than 6.4. Software-only NetBackup deployments are covered by the console advisory, not the Flex OS one.

Is there a workaround instead of upgrading?

Cohesity lists access restrictions as mitigations, but states that they do not fully remove the risk. Upgrading to the fixed releases is required.

Talk to us

Virtech helps GCC organisations plan and run data-protection upgrades with minimal disruption, from version assessment and compatibility checks to recovery testing and audit-ready documentation.

Talk to Virtech's Enterprise Vault team — call or WhatsApp Virgil on +971 55 700 8578.

Sources: Cohesity advisory COH-2026-0002 · Cohesity advisory COH-2026-0001 · CVE-2026-108925 record