anonhaven

CVE-2026-108925

MEDIUM CVSS 3.1: 6.1 EPSS 0.21%
Updated Oct 16, 2026
Cohesity
Parameter Value
CVSS 6.1 (MEDIUM)
Affected Versions before 11.2.
Type CWE-80 (Improper Neutralization of Script-Related HTML Tags (XSS))
Vendor Cohesity
Public PoC No

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web interface. This issue affects NetBackup Administration Console web interface:  versions before 11.2. https://github.com/cohesity/SecAdvisory/blob/master/COH-2026-0002.md

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required

Impact Assessment

Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-80 Improper Neutralization of Script-Related HTML Tags (XSS)

Vulnerable Products

cohesity:netbackup administration console web interface

References 1

https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip…
cna@cyber.gov.il
Share Post Share Share Share

Related Vulnerabilities

CVE-2025-67840

Cohesity

7.2

CVE-2025-63912

Cohesity

7.5

CVE-2025-63911

Cohesity

7.2

CVE-2025-63910

Cohesity

7.2

CVE-2025-63909

Cohesity

7.8