Veritas Netbackup

Unquoted Service Path in Veritas NetBackup 7.0 Enables Elev. Code Exec
CVE-2020-37045 7.8 - High - February 01, 2026

Veritas NetBackup 7.0 contains an unquoted service path vulnerability in the NetBackup INET Daemon service that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files\Veritas\NetBackup\bin\bpinetd.exe to inject malicious code that would execute with elevated LocalSystem privileges.

Unquoted Search Path or Element

Veritas NetBackup <10.5 Windows DLL injection via command execution
CVE-2024-52945 7.8 - High - November 18, 2024

An issue was discovered in Veritas NetBackup before 10.5. This only applies to NetBackup components running on a Windows Operating System. If a user executes specific NetBackup commands or an attacker uses social engineering techniques to impel the user to execute the commands, a malicious DLL could be loaded, resulting in execution of the attacker's code in the user's security context.

NetBackup Governance Mode Retention Lock Bypass Prior 10.4/5.4
CVE-2024-34404 - May 03, 2024

A vulnerability was discovered in the Alta Recovery Vault feature of Veritas NetBackup before 10.4 and NetBackup Appliance before 5.4. By design, only the cloud administrator should be able to disable the retention lock of Governance mode images. This vulnerability allowed a NetBackup administrator to modify the expiration of backups under Governance mode (which could cause premature deletion).

Veritas NetBackup<10.4 MT Agent Enables Arbitrary File Delete
CVE-2024-33672 7.1 - High - April 26, 2024

An issue was discovered in Veritas NetBackup before 10.4. The Multi-Threaded Agent used in NetBackup can be leveraged to perform arbitrary file deletion on protected files.

Upload/Exec Exploit in Veritas NetBackup BPCD before 8.1.2 / 3.1.2
CVE-2024-28222 9.8 - Critical - March 07, 2024

In Veritas NetBackup before 8.1.2 and NetBackup Appliance before 3.1.2, the BPCD process inadequately validates the file path, allowing an unauthenticated attacker to upload and execute a custom file.

Directory traversal

Veritas NetBackup <8.3.0.2 BPCD Log Overwrite Vulnerability
CVE-2023-28758 7.1 - High - March 23, 2023

An issue was discovered in Veritas NetBackup before 8.3.0.2. BPCD allows an unprivileged user to specify a log file path when executing a NetBackup command. This can be used to overwrite existing NetBackup log files.

Veritas NetBackup <10.0 DLL Path Validation Bypass Elevates Privileges
CVE-2023-28759 7.8 - High - March 23, 2023

An issue was discovered in Veritas NetBackup before 10.0 on Windows. A vulnerability in the way the client validates the path to a DLL prior to loading may allow a lower-level user to elevate privileges and compromise the system.

DLL preloading

Authenticated Non-Root Users Run Arbitrary Commands as Root via Java Admin Console in Veritas NetBac
CVE-2022-45461 8.8 - High - November 17, 2022

The Java Admin Console in Veritas NetBackup through 10.1 and related Veritas products on Linux and UNIX allows authenticated non-root users (that have been explicitly added to the auth.conf file) to execute arbitrary commands as root.

Shell injection

Denial of Service via nbars Crash in Veritas NetBackup 10.0.0.1
CVE-2022-42300 6.5 - Medium - October 03, 2022

An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server nbars process can be crashed resulting in a denial of service. (Note: the watchdog service will automatically restart the process.)

Path Traversal Deleting Files in Veritas NetBackup 8.2 (pbx_exchange)
CVE-2022-42308 7.1 - High - October 03, 2022

An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can delete arbitrary files by leveraging a path traversal in the pbx_exchange registration code.

Directory traversal

Veritas NetBackup 10.x XXE Injection via DiscoveryService (CVE-2022-42307)
CVE-2022-42307 9.8 - Critical - October 03, 2022

An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) Injection attack through the DiscoveryService service.

XXE

Veritas NetBackup <=8.2 DoS via pbx_exchange NULL pointer crash (local)
CVE-2022-42306 5.5 - Medium - October 03, 2022

An issue was discovered in Veritas NetBackup through 8.2 and related Veritas products. An attacker with local access can send a crafted packet to pbx_exchange during registration and cause a NULL pointer exception, effectively crashing the pbx_exchange process.

NULL Pointer Dereference

Veritas NetBackup 10.0.0.1 Path Traversal via DiscoveryService
CVE-2022-42305 7.5 - High - October 03, 2022

An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a Path traversal attack through the DiscoveryService service.

Directory traversal

Veritas NetBackup <=10.0 SQL Injection in idm, nbars, SLP Manager
CVE-2022-42304 9.8 - Critical - October 03, 2022

An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection attack affecting idm, nbars, and SLP manager code.

SQL Injection

Veritas NetBackup <10.0 SQLi (Second-Order via NBFSMCLIENT) CVE-2022-42303
CVE-2022-42303 9.8 - Critical - October 03, 2022

An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a second-order SQL Injection attack affecting the NBFSMCLIENT service by leveraging CVE-2022-42302.

SQL Injection

Veritas NetBackup XXE via nbars (v <=10.0.0.1)
CVE-2022-42301 8.8 - High - October 03, 2022

An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to an XML External Entity (XXE) injection attack through the nbars process.

XXE

NetBackup Primary Server DoS via DiscoveryService (10.0.0.1)
CVE-2022-42299 7.5 - High - October 03, 2022

An issue was discovered in Veritas NetBackup through 10.0.0.1 and related Veritas products. The NetBackup Primary server is vulnerable to a denial of service attack through the DiscoveryService service.

SQLi in Veritas NetBackup <=10.0 NBFSMCLIENT Service
CVE-2022-42302 9.8 - Critical - October 03, 2022

An issue was discovered in Veritas NetBackup through 10.0 and related Veritas products. The NetBackup Primary server is vulnerable to a SQL Injection attack affecting the NBFSMCLIENT service.

SQL Injection

Veritas NetBackup RCE on Primary/Media 8.1-9.1 (Auth.)
CVE-2022-36988 8.8 - High - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup OpsCenter server, NetBackup Primary server, or NetBackup Media server could remotely execute arbitrary commands on a NetBackup Primary server or NetBackup Media server.

Veritas NetBackup 8.x-9.x Authenticated Client DoS on Primary
CVE-2022-36984 6.5 - Medium - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup Client could remotely trigger a denial of service attack against a NetBackup Primary server.

Veritas NetBackup Windows Local Privilege Escalation (CVE-2022-36985)
CVE-2022-36985 7.8 - High - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with unprivileged local access to a Windows NetBackup Primary server could potentially escalate their privileges.

Veritas NetBackup RCE via Unauth Access (8.1-9.1.0.1)
CVE-2022-36986 9.8 - Critical - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with unauthenticated access could remotely execute arbitrary commands on a NetBackup Primary server.

Veritas NetBackup <=9.1.0.1 Arbitrary File Write via Authenticated Client
CVE-2022-36987 6.5 - Medium - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup Client could arbitrarily write files to a NetBackup Primary server.

Veritas NetBackup RCE (8.1.x-9.1.0.1) via Authenticated Client
CVE-2022-36989 8.8 - High - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup Client could remotely execute arbitrary commands on a NetBackup Primary server.

Veritas NetBackup 8.19.1.x Authenticated Remote File Read (RFR)
CVE-2022-37000 6.5 - Medium - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). Under certain conditions, an attacker with authenticated access to a NetBackup Client could remotely read files on a NetBackup Primary server.

Remote File Read in Veritas NetBackup 8.1-9.1 (Client Auth)
CVE-2022-36999 6.5 - Medium - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). Under certain conditions, an attacker with authenticated access to a NetBackup Client could remotely read files on a NetBackup Primary server.

Stack Buffer Overflow Vulnerability in Veritas NetBackup <=9.1.0.1 on Client
CVE-2022-36998 6.5 - Medium - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup Client could remotely trigger a stack-based buffer overflow on the NetBackup Primary server, resulting in a denial of service.

Memory Corruption

Veritas NetBackup 8.x-9.x Client SSRF & Arbitrary File Read (CVE-2022-36997)
CVE-2022-36997 8.8 - High - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup Client could remotely trigger impacts that include arbitrary file read, Server-Side Request Forgery (SSRF), and denial of service.

SSRF

Veritas NetBackup Client Data Disclosure - 8.1.x-9.1.0.1
CVE-2022-36996 6.5 - Medium - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with access to a NetBackup Client could remotely gather information about any host known to a NetBackup Primary server.

Veritas NetBackup 8.19.1: Client Can Create Directories on Primary
CVE-2022-36995 4.3 - Medium - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup Client could arbitrarily create directories on a NetBackup Primary server.

Veritas NetBackup 8.1-9.1 Arbitrary File Read via Authenticated Client
CVE-2022-36994 6.5 - Medium - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup Client could arbitrarily read files from a NetBackup Primary server.

Veritas NetBackup 8.1.x-9.1.0.1 Authenticated Client Remote Cmd Exec
CVE-2022-36993 8.8 - High - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup Client could remotely execute arbitrary commands on a NetBackup Primary server.

Veritas NetBackup 8.1-9.1 Auth RCE via Client Notify
CVE-2022-36992 8.8 - High - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup Client could remotely execute arbitrary commands on a NetBackup Primary server (in specific notify conditions).

Veritas NetBackup 8.1-9.1.x Authenticated Client Arbitrary File Write
CVE-2022-36991 6.5 - Medium - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup Client could arbitrarily write content to a partially controlled path on a NetBackup Primary server.

Veritas NB 8.19.1 RFW via Authed Client
CVE-2022-36990 6.5 - Medium - July 28, 2022

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 (and related NetBackup products). An attacker with authenticated access to a NetBackup Client could remotely write arbitrary files to arbitrary locations from any Client to any other Client via a Primary server.

Veritas NetBackup 9.x: RCE via stolen host-id cert
CVE-2022-36956 7.5 - High - July 27, 2022

In Veritas NetBackup, the NetBackup Client allows arbitrary command execution from any remote host that has access to a valid host-id NetBackup certificate/private key from the same domain. The affects 9.0.x through 9.0.0.1 and 9.1.x through 9.1.0.1.

Veritas NetBackup OpsCenter 8.x-10 DOM XSS
CVE-2022-36948 5.4 - Medium - July 27, 2022

In Veritas NetBackup OpsCenter, a DOM XSS attack can occur. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.

XSS

Veritas NetBackup OpsCenter local privilege escalation before 10.0.0
CVE-2022-36949 7.8 - High - July 27, 2022

In Veritas NetBackup OpsCenter, an attacker with local access to a NetBackup OpsCenter server could potentially escalate their privileges. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.

Veritas NetBackup OpsCenter RCE via Java ClassLoader (8.x-10)
CVE-2022-36950 9.8 - Critical - July 27, 2022

In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may be able to perform remote command execution through a Java classloader manipulation. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.

NetBackup OpsCenter RCE via Unpatched Vulnerability (v8-10)
CVE-2022-36951 9.8 - Critical - July 27, 2022

In Veritas NetBackup OpsCenter, an unauthenticated remote attacker may compromise the host by exploiting an incorrectly patched vulnerability. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.

Hard-Coded Credential in Veritas NetBackup OpsCenter 8.x-10.x
CVE-2022-36952 9.8 - Critical - July 27, 2022

In Veritas NetBackup OpsCenter, a hard-coded credential exists that could be used to exploit the underlying VxSS subsystem. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.

Use of Hard-coded Credentials

Veritas NB OpsCenter 8.3-10 Sensitive Data Leak via Unauth Remote Endpoints
CVE-2022-36953 4.3 - Medium - July 27, 2022

In Veritas NetBackup OpsCenter, certain endpoints could allow an unauthenticated remote attacker to gain sensitive information. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.

Auth Remote Acc Creation in Veritas NetBackup OpsCenter 8.x-10
CVE-2022-36954 6.5 - Medium - July 27, 2022

In Veritas NetBackup OpsCenter, under specific conditions, an authenticated remote attacker may be able to create or modify OpsCenter user accounts. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10.

Veritas NetBackup Client Priv Escal via Unpriv Local Access (8.09.1)
CVE-2022-36955 8.4 - High - July 27, 2022

In Veritas NetBackup, an attacker with unprivileged local access to a NetBackup Client may send specific commands to escalate their privileges. This affects 8.0 through 8.1.2, 8.2, 8.3 through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1.

Veritas NetBackup OpsCenter Analytics 9.1
CVE-2021-41570 5.4 - Medium - April 19, 2022

Veritas NetBackup OpsCenter Analytics 9.1 allows XSS via the NetBackup Master Server Name, Display Name, NetBackup User Name, or NetBackup Password field during a Settings/Configuration Add operation.

XSS