TI-2026-25447 Aliases CVE-2026-32999 GHSA-x8w2-9wjv-3hv6

Code injection in WebPros Comet Backup

MEDIUM 41CWE-94Published 2026-05-28 · Updated 2026-05-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00313 24th percentileScored 2026-11-07

Fix Fixed Comet Backup (WebPros): 26.4.3, 26.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WebPros	Comet Backup	before 26.4.3; before 26.5.0	26.4.3, 26.5.0	Patch available	CNA

Comet Backup VendorWebPros Affected before 26.4.3; before 26.5.0 Fixed in 26.4.3, 26.5.0 Patch available CNA

Remediation

Fix · CNA Comet Backup (WebPros) Fixed in 26.4.3, 26.5.0

Timeline

2026-10-02 Threatist record created from CVE-2026-32999
2026-10-03 Alias added: GHSA-x8w2-9wjv-3hv6

References

Other 1

https://support.cometbackup.com/hc/en-us/articles/40655100268439--CVE-2026-32999-RCE-on-Comet-Server-via-branding-configuration

TI-2026-30342 WebPros cPanel and WHM Authentication Bypass via Login Flow KEVCVSS 4.0CRITICAL 9.3
TI-2026-46792 Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root. CVSS 4.0HIGH 8.7
TI-2025-40383 Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS)… CVSS 3.1HIGH 7.5
TI-2026-23322 Incorrect privileges management and insufficient path filtering allow to read arbitrary… CVSS 3.1HIGH 8.6
TI-2026-47685 Deserialization of untrusted data in WebPros WHMCS CVSS 4.0CRITICAL 9.3
TI-2026-23317 Authorization bypass in WebPros Comet Backup CVSS 4.0CRITICAL 9.9

See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences