External risk intelligence

NetBackup Flex OS Arbitrary Code Execution via Privileged Command Input

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-28197

The vulnerability exists within the management shell of a backup appliance. While network-accessible, such administrative interfaces are typically restricted to internal management networks and are not intended for exposure to the public internet in standard deployment patterns.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a critical flaw in the NetBackup Flex OS management shell, allowing an authenticated user to execute arbitrary code with full administrative control. Exploitation could lead to a complete compromise of the appliance, affecting data confidentiality, integrity, and availability.

Low-privilege user gains root access.
Full control of backup appliance possible.
Confirm if NetBackup Flex OS is in use.

Attack Path

How an attacker could exploit the issue

An attacker with low-level access to the NetBackup Flex OS management shell can exploit this vulnerability. By providing specially crafted input to an administrative command, they can execute arbitrary code with root privileges. This grants them complete control over the appliance and its hosted containers.

Entry: Authenticated, low-privileged access to management shell.
Trigger: Specially crafted input to administrative command.
Risk: Unrestricted control over host and containers.

Live Threat

Current exploitation, exposure, and threat context

An authenticated, low-privileged user could execute arbitrary code with root privileges on the NetBackup Flex OS management shell. This occurs when a specially crafted input is supplied to a privileged administrative command. When supported by the advisory, this could grant an attacker unrestricted control over the Flex appliance host and its containers.

Appliance host and hosted containers.
Authenticated, low-privileged user input.
Complete compromise of confidentiality, integrity, availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

Compromise of the NetBackup Flex OS management shell requires authenticated access, suggesting that platform or infrastructure teams responsible for the appliance and its access controls are the primary actors. The initial step is to confirm the presence of NetBackup Flex appliances, assess their network exposure, and identify the system owner for remediation planning.

Ownership: Platform or infrastructure teams.
Verify first: Appliance presence and network reachability.
Action: Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NetBackup Flex OS?

NetBackup Flex OS is the underlying operating system and management environment for Veritas NetBackup Flex appliances. These systems are enterprise-grade data protection solutions designed to host backup services and containers. They provide administrative shells used by infrastructure teams to manage system resources, monitor operations, and secure backup data storage.

What does CVE-2026-28197 mean?

This vulnerability is classified as CWE-88: Improper Neutralization of Argument Delimiters in a Command. In plain terms, the system fails to properly sanitize inputs provided to certain administrative commands. An authenticated user can leverage this flaw to inject extra instructions, tricking the management shell into executing unintended code with the highest possible (root) system privileges.

How is this vulnerability triggered?

An attacker must already have authenticated, low-privileged access to the NetBackup Flex OS management shell. The issue is triggered only when a user intentionally submits specially crafted input to a privileged command. Simply logging into the shell or performing standard, legitimate administrative tasks does not trigger this flaw; it requires the specific, malicious injection of data into sensitive command fields.

Is my NetBackup Flex appliance at risk?

Halo Surface Signal indicates that while this flaw is network-accessible, the risk is typically low for standard deployments. Because the management shell is generally restricted to internal management networks, it is not intended for public internet exposure. You should assess whether your appliances are reachable from untrusted network segments or if access is properly segmented to authorized administrators only.

What should I do to address CVE-2026-28197?

Begin by identifying all NetBackup Flex appliances within your infrastructure to confirm which systems are present. Verify their current network access controls to ensure the management shell is not exposed to unnecessary users or external networks. Engage your platform or infrastructure teams to review access logs and prepare for official updates or configuration guidance provided by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.