CVE-2026-108925 in NetBackup Administration Console
Summary
by MITRE • 10/11/2026
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web interface.
This issue affects NetBackup Administration Console web interface: versions before 11.2.
https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0002.md
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified as COH-2026-0002 represents a classic Cross-Site Scripting (XSS) flaw within the Cohesity NetBackup Administration Console web interface, specifically affecting versions prior to 11.2. This security defect is categorized under CWE-79, which denotes Improper Neutralization of Input During Web Page Generation commonly known as 'Cross-site Scripting'. The core technical issue stems from a failure in input validation and output encoding mechanisms within the application's server-side logic or client-side rendering engine. When user-supplied data is processed by the administration console without adequate sanitization, malicious script tags are injected into the HTML response stream rather than being escaped as plain text. This allows an attacker to execute arbitrary JavaScript code within the context of the victim’s browser session, bypassing same-origin policy restrictions that typically isolate web applications from each other.
The operational impact of this vulnerability is significant due to the privileged nature of the NetBackup Administration Console. As a management interface for enterprise backup infrastructure, it provides administrators with access to critical data storage systems and configuration settings. An attacker who successfully exploits this XSS flaw can perform actions such as stealing session cookies or authentication tokens, thereby hijacking administrative sessions without needing valid credentials. Furthermore, the vulnerability enables phishing attacks where malicious content is rendered within the trusted interface of the administration console, potentially tricking legitimate administrators into revealing sensitive information or executing commands on their local machines through drive-by downloads or social engineering tactics embedded in the injected scripts. The ability to execute arbitrary code also allows for keylogging capabilities, capturing keystrokes entered by system administrators, which could lead to further compromise of backend systems and data exfiltration.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059.007, JavaScript Execution, specifically within the context of client-side code execution via web browsers. The attack vector is typically classified as Remote (Network) but requires user interaction or access to the administrative interface, placing it in a medium-risk category depending on network segmentation and authentication requirements. If the administration console is exposed directly to untrusted networks without additional protective controls such as Web Application Firewalls or strict content security policies, the risk escalates significantly. The lack of proper neutralization means that any input field accepting user data can serve as an entry point for these malicious payloads, making the scope of exploitation potentially broad across various administrative functions within the console.
Mitigation strategies must prioritize immediate patching to version 11.2 or later, where Cohesity has addressed the underlying code flaws responsible for this improper neutralization. In scenarios where upgrading is not immediately feasible, organizations should implement compensating controls such as deploying a Web Application Firewall configured with rulesets designed to detect and block common XSS payloads including script tags, event handlers, and encoded variants thereof. Additionally, enforcing strict Content Security Policy headers can restrict the sources from which scripts are allowed to execute, thereby mitigating the impact of any successfully injected code. Regular security audits and penetration testing focused on input validation logic should be conducted to ensure that similar vulnerabilities do not exist in other parts of the administration interface or related web services associated with the NetBackup ecosystem.