Cryptographic signature verification bypass enables root shell on Cohesity NetBackup Flex OS

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verification step of a privileged support command by supplying a specially formed access credential. Successful exploitation grants the attacker an unrestricted root shell with full control over the Flex appliance host and all hosted containers, completely compromising confidentiality, integrity, and availability.

• Cohesity NetBackup Flex OS: The record sets default_status to unaffected and identifies version 0 with lessThan: 6.4 as affected under the custom version scheme.
• Cohesity's advisory describes the corresponding scope as versions before 6.4.
• No additional parallel release branch or version scope is confirmed by the available evidence.

Cohesity NetBackup Flex OS fails to properly verify the cryptographic signature for a privileged support command. An authenticated, low-privileged user with access to the management shell can supply a specially formed access credential that bypasses this verification step. The privileged command then provides an unrestricted root shell on the Flex appliance host and all hosted containers. Exploitation requires authenticated access to the management shell; the supplied attack characteristics indicate network reachability, no user interaction, and low attack complexity. The available evidence does not identify the specific command, credential format, signature algorithm, endpoint, or implementation detail responsible for the verification bypass.

Exploitation is reachable over the network and requires an authenticated low-privileged account with access to the NetBackup Flex OS management shell. No additional user interaction is required, and the supplied attack characteristics describe low complexity. The attacker supplies a specially formed access credential to a privileged support command to bypass cryptographic signature verification. The record marks public exploit as false, while known exploited status is not established; the inspected advisory also does not document exploitation in the wild. The evidence does not indicate that administrative privileges are required before the initial shell access.

Successful exploitation provides an unrestricted root shell on the Flex appliance host and all hosted containers. The technical outcome described by the record is complete compromise of confidentiality, integrity, and availability within the reach of the compromised host or containers. This could enable data access, unauthorized configuration or software changes, destruction of data, and service disruption. The flaw begins with an authenticated low-privileged account, but the evidence does not establish which resources that account can reach before privilege escalation.

The flaw can turn low-privileged shell access into root-level control of the Flex appliance host and its hosted containers.

• Data: An attacker could access or modify data and configuration reachable from the compromised host or containers.
• Operations: An attacker could degrade or disrupt services running on the appliance and its containers.
• System integrity: The host and workloads could be altered without authorization, potentially affecting administration and service behavior.
• Evidence limit: The available evidence does not identify a specific organization, dataset, or service that was compromised in practice.

1. Upgrade Cohesity NetBackup Flex OS to version 6.4 or later, as specified in Cohesity's remediation guidance. This is the primary action because the advisory states that no compensating control fully eliminates the risk.
2. Until the upgrade is complete, restrict NetBackup Flex OS management shell access to authorized administrators and remove unnecessary access assignments.
3. Review accounts that accessed the management shell and activity involving the privileged support command for signs of anomalous credential use.
4. After upgrading, recheck asset inventory, version status, and shell access permissions on both the appliance host and hosted containers.

1. Inventory Cohesity NetBackup Flex OS appliances and verify their installed versions through asset records or the management interface.
2. Identify every account with management shell access, especially low-privileged accounts, and confirm that each assignment is operationally required.
3. Review authentication and audit logs for unusual management shell access, use of the privileged support command, or anomalous credentials if those events are recorded by the appliance.
4. Check for unauthorized changes on the appliance host and hosted containers following suspicious shell access.
5. No specific IOC, log event name, or credential pattern is provided by the available evidence. Additional monitoring should therefore be treated as a precaution, not as proof that an appliance is safe.