CVE-2026-108925

6.1Medium

Published 11 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.1Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-80

Impact

Attackers can run arbitrary JavaScript in an administrator's browser session to steal tokens or execute unauthorized actions. This requires convincing an administrative user to click a malicious link or visit a crafted page.

Root cause

The NetBackup Administration Console web interface fails to sanitize script-related HTML tags in input, allowing cross-site scripting (XSS).

Affected systems

Cohesity NetBackup Administration Console web interface versions before 11.2.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade the NetBackup Administration Console to version 11.2 or later. If immediate patching is not possible, restrict network access to the console web interface to trusted administrative IPs.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web interface. This issue affects NetBackup Administration Console web interface: versions before 11.2. https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0002.md

References

https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0

Source: nvd.nist.gov/vuln/detail/CVE-2026-108925