Read the docs
TI-2026-70798 Aliases CVE-2026-108925GHSA-qc8q-qx52-mgwm

Cross-site scripting in Cohesity NetBackup Administration Console

Priority LOW 27CWE-80Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-80.

Summary

The Cohesity NetBackup Administration Console web interface before 11.2 does not neutralize script-related HTML tags in web pages (CWE-80). A remote attacker without privileges can get script to run in a user's browser if the user interacts with a crafted page, which affects the confidentiality and integrity of the console session.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web interface. This issue affects NetBackup Administration Console web interface:  versions before 11.2. https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0002.md

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00205 10th percentileScored 2026-11-07
Fix Fixed NetBackup Administration Console web interface (Cohesity): 11.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CohesityNetBackup Administration Console web interfacebefore 11.211.2Patch availableCNA
  • NetBackup Administration Console web interface VendorCohesity Affected before 11.2 Fixed in 11.2 Patch available CNA

Remediation

The sources list no fixed version for NetBackup Administration Console web interface.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA NetBackup Administration Console web interface (Cohesity) Fixed in 11.2

Timeline

  1. 2026-10-11 Threatist record created from CVE-2026-108925
  2. 2026-10-11 Alias added: GHSA-qc8q-qx52-mgwm
  3. 2026-10-12 Priority changed: MEDIUM → LOW
  4. 2026-10-16 CISA SSVC decision points changed

References

Other 1

  • TI-2021-09357 Undocumented Default Cryptographic Key Vulnerability in Cohesity DataPlatform version 6.3… CVSS 3.1CRITICAL 9.8
  • TI-2026-22536 Privilege Escalation via Argument Injection in NetBackup Flex OS Shell CVSS 4.0CRITICAL 9.4
  • TI-2026-22537 Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell CVSS 4.0CRITICAL 9.4
  • TI-2025-41479 Multiple authenticated OS command injection vulnerabilities exist in the Cohesity… CVSS 3.1HIGH 7.2
  • TI-2025-39485 Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to contain… CVSS 3.1HIGH 7.2
  • TI-2025-39483 Incorrect access control in the component /opt/SRLtzm/bin/TapeDumper of Cohesity TranZman… CVSS 3.1HIGH 7.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences