Read the docs
TI-2025-41479 Aliases CVE-2025-67840GHSA-j46m-h6wf-3gc4

Multiple authenticated OS command injection vulnerabilities exist in the Cohesity…

Priority MEDIUM 40CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Multiple authenticated OS command injection vulnerabilities exist in the Cohesity (formerly Stone Ram) TranZman 4.0 Build 14614 through TZM_1757588060_SEP2025_FULL.depot web application API endpoints (including Scheduler and Actions pages). The appliance directly concatenates user-controlled parameters into system commands without sufficient sanitisation, allowing an authenticated admin user to inject and execute arbitrary OS commands with root privileges. An attacker can intercept legitimate requests (e.g. during job creation or execution) using a proxy and modify parameters to include shell metacharacters, achieving remote code execution on the appliance. This completely bypasses the intended CLISH restricted shell confinement and results in full system compromise. The vulnerabilities persist in Release 4.0 Build 14614 including the latest patch (as of the time of testing) TZM_1757588060_SEP2025_FULL.depot.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04061 90th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cohesity:tranzman:4.0:build14614:*:*:*:*:*:*4.0 build14614VulnerableCohesity
  • cpe:2.3:a:cohesity:tranzman:4.0:build14614:*:*:*:*:*:* Versions 4.0 build14614 Vulnerable ·Cohesity

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-67840
  2. 2026-10-03 Alias added: GHSA-j46m-h6wf-3gc4
  3. 2026-10-21 EPSS moved to the 90th–95th percentile

References

Exploit 1

Advisory 1

Other 1

  • TI-2025-39485 Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to contain… CVSS 3.1HIGH 7.2
  • TI-2025-39483 Incorrect access control in the component /opt/SRLtzm/bin/TapeDumper of Cohesity TranZman… CVSS 3.1HIGH 7.8
  • TI-2025-39484 An authenticated arbitrary file upload vulnerability in Cohesity TranZman Migration… CVSS 3.1HIGH 7.2
  • TI-2025-39486 Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to use a… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences