CVE-2026-28199

Executive Summary

CVE-2026-28199 is an authenticated local file disclosure vulnerability in the NetBackup Flex OS management shell, a component of Veritas NetBackup Flex appliances. An attacker who already holds valid credentials with access to this restricted management shell can supply a specially crafted path argument to a diagnostic command, causing the underlying operating system to return the contents of arbitrary files. Successful exploitation exposes sensitive system configuration and credential material stored on the appliance, but requires local access and an existing authenticated session, which constrains the practical severity to a CVSS base score of 3.3.

Technical Analysis

CVE-2026-28199 affects the NetBackup Flex OS management shell — the restricted interactive environment exposed to administrative users of NetBackup Flex appliances for maintenance and diagnostic operations. According to the NVD description, the flaw resides in a diagnostic command that accepts a caller-supplied path argument. Because the command does not adequately restrict or validate that path, an authenticated user can point it at files outside the intended scope, resulting in disclosure of OS-level file contents.

The vulnerability is classified under CWE-347 (Improper Verification of Cryptographic Signature). In practice, this classification indicates that the affected diagnostic routine does not properly authenticate or integrity-check the data or code path it operates on — i.e., it fails to verify that the requested resource is a legitimate, approved target before acting on it. The observable consequence is a path-based information disclosure primitive rather than code execution or privilege escalation.

Key technical constraints derivable strictly from the available data:

• Access precondition: The attacker must be an authenticated user who has been granted access to the NetBackup Flex OS management shell. This is not a pre-authentication or network-perimeter flaw.
• Attack vector: Local (AV:L). The crafted path argument is supplied directly to a diagnostic command within the management shell environment, not over an unauthenticated remote interface.
• Complexity: Low (AC:L). No race condition or unusual conditions are required once shell access exists.
• Privileges required: Low (PR:L), consistent with a user who already possesses a shell session but is not necessarily a full OS-level root/administrator.
• User interaction: None (UI:N) beyond the attacker's own command entry.
• Impact: Confidentiality Low only (C:L); Integrity and Availability are None. The management shell's file read is constrained — it leaks file contents but does not modify or destroy data, and does not by itself grant a full OS shell.

The precise name of the affected diagnostic command, the exact parameter name, and the exact vulnerable code path are not disclosed in the available NVD description. No function names, class names, file paths, or API endpoints can be confirmed from the supplied intelligence; any such specifics would be speculation and are deliberately omitted here.

Weakness in path handling of this type is often a path-traversal or arbitrary-file-read class of defect (frequently mapped to CWE-22 or CWE-73), but the authoritative classification supplied for this CVE is CWE-347. Analysts should treat the disclosed behavior — reading arbitrary files via a crafted path to a diagnostic command — as the ground truth and avoid over-specifying the implementation mechanism.

The exposure of "sensitive system configuration and credential material" is the crux of the risk: NetBackup Flex appliances store backup infrastructure credentials, service account secrets, and appliance configuration that could be leveraged to pivot deeper into a backup environment — a high-value target given that backup systems often hold the keys to an organization's most sensitive data.

Exploitation Scenarios

The following attack chain is inferred strictly from the vulnerability class and the NVD description. No public proof-of-concept or exploit code is available, and no CNA title was provided, so the steps below are described at the vulnerability-class level only. No specific command names, parameter names, or file paths are asserted because none are disclosed in the source data.

1) Reconnaissance / Target Identification The attacker must first obtain authenticated access to a NetBackup Flex appliance and to its OS management shell. This implies either a legitimate but over-privileged account, a compromised credential, or a user who has been granted shell access for operational duties. Reconnaissance focuses on confirming that the appliance is a NetBackup Flex system and that the management shell is reachable with the attacker's credentials.

2) Triggering the Flaw Once inside the management shell, the attacker invokes a diagnostic command that accepts a filesystem path as an argument. The attacker supplies a specially crafted path — designed to escape the command's intended scope — in place of a legitimate target. Because the command does not properly verify/restrict that path (CWE-347), it resolves and reads a file outside the intended boundary.

3) Payload / Execution Method (vulnerability-class level) This is a local file-read primitive, not remote code execution. There is no payload delivery in the conventional sense; the "payload" is the crafted path argument itself. The command returns the contents of the targeted file to the authenticated shell session. No memory corruption, no code injection, and no privilege escalation are indicated by the CVSS vector or the description.

4) Post-Exploitation Impact The attacker reads files that expose sensitive system configuration and credential material stored on the appliance. Depending on what is readable, this could include appliance configuration and stored secrets. Such material may enable lateral movement, credential reuse against other systems, or deeper compromise of the backup infrastructure. Integrity and availability are unaffected (I:N/A:N); the impact is confined to confidentiality (C:L).

Constraints and caveats: The attack requires prior authenticated shell access (PR:L, AV:L), limiting its use to insiders, attackers who have already obtained credentials, or a secondary stage of a broader intrusion. There is no evidence of in-the-wild exploitation, no CISA KEV listing, no EPSS score, and no public tooling.

Impact Assessment

The CVSS 3.1 base score is 3.3 (Low), driven by the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Each subscore and its business meaning:

• AV:L (Local): The attacker must operate from within the appliance's management shell environment. This dramatically narrows the reachable attack surface — remote, unauthenticated internet-facing exploitation is not possible.
• AC:L (Low): No special conditions are needed; exploiting is straightforward once the precondition (shell access) is met.
• PR:L (Low): Some privilege is required — an authenticated shell session — but not full administrative/OS-root access.
• UI:N (None): No victim user must be tricked; the attacker acts directly.
• S:U (Unchanged): Exploitation does not cross a security scope boundary; impact stays within the appliance's authorization context.
• C:L / I:N / A:N: Only limited confidentiality impact. No modification or destruction of data, no denial of service.

Business impact: Although the CVSS score is Low, the contextual risk is elevated. Backup infrastructure is a crown-jewel target: NetBackup Flex appliances hold credentials and configuration that protect or provide access to enterprise backup data. Disclosure of that material could enable an attacker to reach backup repositories, delete or exfiltrate backups (a common ransomware precursor), or reuse credentials elsewhere. Organizations that grant broad or unnecessary management-shell access effectively widen the blast radius.

Blast radius: Limited to the specific appliance and the credentials/configuration reachable from it. Because exploitation requires existing authenticated shell access, the vulnerability is most dangerous as a post-compromise privilege/visibility amplifier rather than an initial entry point. The integrity of the backup chain is not directly compromised by this flaw, but confidentiality loss of credential material is a serious secondary risk.

Detection Guidance

Note: The following rules are constructed at the vulnerability-class level (local file disclosure via a crafted path argument in a management shell). Because the exact command name and parameter are not disclosed, detection logic targets behavioral patterns — abnormal path arguments / file reads — rather than a specific known-bad string. Tune paths, process names, and indexes to your environment before deployment.

Sigma Rule

title: NetBackup Flex OS Management Shell Arbitrary File Read via Diagnostic Command
id: 3f9c1a72-6b4e-4d58-9c2a-2819netbackup
status: experimental
description: Detects suspicious path arguments supplied to diagnostic commands in the NetBackup Flex OS management shell, consistent with CVE-2026-28199 arbitrary file read.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-28199
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_exec:
    type: 'EXECVE'
    a0|contains:
      - 'nb'          # placeholder: tune to actual management-shell binary
  selection_suspicious_path:
    a1|contains:
      - '../'
      - '/etc/'
      - '/etc/shadow'
      - '/var/'
      - '.ssh'
      - 'id_rsa'
      - 'credentials'
  condition: selection_exec and selection_suspicious_path
falsepositives:
  - Legitimate administrative diagnostics referencing /etc or /var paths
level: medium
tags:
  - attack.t1083
  - cve.2026.28199

YARA Rule

rule CVE_2026_28199_NetBackup_Flex_File_Read_Markers
{
    meta:
        author = "valtersit.com"
        description = "Heuristic markers for logs/artifacts referencing NetBackup Flex management shell arbitrary file read (CVE-2026-28199). Class-level; tune to environment."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-28199"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $nb1 = "NetBackup" ascii wide nocase
        $nb2 = "NetBackup Flex" ascii wide nocase
        $nb3 = "management shell" ascii wide nocase
        $nb4 = "nbsu" ascii wide nocase
        $path1 = "../" ascii
        $path2 = "/etc/" ascii
        $path3 = "/etc/shadow" ascii
        $path4 = "credentials" ascii wide nocase

    condition:
        (uint16(0) == 0x5A4D or true) and
        (any of ($nb*)) and
        (any of ($path*))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-28199 NetBackup Flex OS mgmt shell path manipulation attempt (file read)"; flow:established,to_server; content:"NetBackup"; nocase; content:"../"; distance:0; within:256; nocase; classtype:attempted-recon; reference:cve,2026-28199; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-28199; sid:2026281991; rev:1;)

Note: This vulnerability is local (AV:L) within a management shell; network detection is best-effort and applies only where shell sessions are proxied/logged over the network (e.g., SSH/management session capture). Tune protocol and inspection to your deployment.

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("nbsh", "bash", "sh", "nbflex", "mgmtshell") and
  process.name in ("cat", "less", "head", "tail", "grep", "awk") and
  process.command_line : ("/etc/shadow*", "*../*", "*credentials*", "*id_rsa*", "*/.ssh/*")

Splunk SPL Query

index=os OR index=linux OR index=netbackup
(sourcetype=auditd OR sourcetype=syslog OR sourcetype=nb_mgmtshell)
(
  (process_name IN ("cat","less","head","tail","grep","awk"))
  OR (command_line="*diagnostic*" OR command_line="*mgmt*shell*")
)
(
  command_line="*../*"
  OR command_line="*/etc/shadow*"
  OR command_line="*/etc/passwd*"
  OR command_line="*credentials*"
  OR command_line="*id_rsa*"
  OR command_line="*/.ssh/*"
)
| stats count min(_time) as firstTime max(_time) as lastTime by host, user, process_name, command_line
| sort - count

Wazuh OSSEC Rule

<group name="netbackup,cve-2026-28199,">
  <rule id="100281991" level="8">
    <decoded_as>json</decoded_as>
    <field name="process.name">cat|less|head|tail|grep|awk</field>
    <field name="process.command_line" type="pcre2">(\.\./|/etc/shadow|/etc/passwd|credentials|id_rsa|/\.ssh/)</field>
    <description>CVE-2026-28199: Possible NetBackup Flex management shell arbitrary file read attempt</description>
    <mitre>
      <id>T1083</id>
    </mitre>
    <group>attack,cve_2026_28199,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was available from any tracked source. No affected version range, vendor fix, or workaround is specified in the supplied data. Treat all current NetBackup Flex OS management shell deployments as potentially affected until Veritas publishes an advisory.

1) Immediate mitigations

• Restrict and review who holds credentials that can access the NetBackup Flex OS management shell; enforce least privilege (CVSS PR:L means a low-privileged shell user is enough to exploit).
• Remove management-shell access from accounts that do not require it; place the appliance management interface on a hardened, segmented management network unreachable from untrusted hosts.
• Enforce strong authentication (MFA where supported) and monitor/anomaly-alert on diagnostic command usage from the management shell.
• Rotate any credentials or secrets that may be stored in configuration reachable from the appliance, on the assumption that file disclosure may already have occurred.
• Apply the behavioral detections in the Detection Guidance section to catch crafted-path diagnostic invocations.

2) Patch / upgrade steps

• No patch is currently available (patch confidence 0/4). Monitor the Veritas NetBackup security advisories page and the NVD entry for CVE-2026-28199 for an official fix.
• When a fixed build is released, inventory all NetBackup Flex appliances, stage the upgrade during a maintenance window, and verify the management-shell component is updated. Retest that the arbitrary-file-read behavior is remediated.

3) Long-term hardening

• Enforce a least-privilege model for appliance management and eliminate shared/standing privileged accounts.
• Adopt ongoing monitoring of diagnostic/management command execution with alerting on suspicious path arguments.
• Segment backup infrastructure from general corporate networks and monitor egress of backup credential material.
• Maintain an asset inventory with version tracking so future advisories can be triaged rapidly.

References

1. NVD — CVE-2026-28199: https://nvd.nist.gov/vuln/detail/CVE-2026-28199
2. Veritas NetBackup Security Advisories (vendor): https://www.veritas.com/support/en_US/security
3. CWE-347 — Improper Verification of Cryptographic Signature: https://cwe.mitre.org/data/definitions/347.html
4. MITRE ATT&CK — T1083 File and Directory Discovery: https://attack.mitre.org/techniques/T1083/
5. CISA Known Exploited Vulnerabilities Catalog (checked; CVE-2026-28199 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild evidence: None. There is no CISA KEV listing, no public PoC, no exploit code, and no reported in-the-wild campaigns associated with CVE-2026-28199 at the time of this report. EPSS has not yet scored this CVE by FIRST.org. All exploitation content in this report is inferred from the vulnerability class and the NVD description only.