What is CVE-2026-28197?

CVE-2026-28197 is a high-severity vulnerability, classified under Argument Injection. CVSS score: 8.8/10. Published 2026-09-18.

How severe is CVE-2026-28197?

High severity. CVSS v3 base score is 8.8 out of 10.

CVE-2026-28197

CVE-2026-28197

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a privileged administrative command, causing it to execute arbitrary code with root-level permissions. Successful exploitation grants the attacker unrestricted control over the Flex appliance host and all hosted containers, fully compromising confidentiality, integrity, and availability.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Weakness classification (CWE)

CWE-88 — Argument Injection

References

a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 (government-resource)
a6d3dc9e-0591-4a13-bce7-0f5b31ff6158 (vendor-advisory)

Frequently asked questions

What is CVE-2026-28197?: CVE-2026-28197 is a high-severity vulnerability, classified under Argument Injection. CVSS score: 8.8/10. Published 2026-09-18.
How severe is CVE-2026-28197?: High severity. CVSS v3 base score is 8.8 out of 10.