CVE-2026-32999

Full vulnerability record from the local CVENow database.

Description

Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices.

Severity

CRITICAL

CVSS score

9.0 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-05-28 05:16:36.107000

Last modified

2026-10-26 12:10:00.130000

View original CVE JSON

{
  "id": "CVE-2026-32999",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-28T05:16:36.107",
  "lastModified": "2026-10-26T12:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices."
    },
    {
      "lang": "es",
      "value": "Filtrado insuficiente de caracteres en el módulo de firma del agente de copia de seguridad en el servidor de Comet Backup permite a un administrador de inquilinos autenticado ejecutar código arbitrario en nombre de un usuario privilegiado en el servidor afectado y dispositivos conectados."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "WebPros",
          "product": "Comet Backup",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "26.4.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "26.5.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T13:09:12.226918Z",
          "id": "CVE-2026-32999",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.cometbackup.com/hc/en-us/articles/40655100268439--CVE-2026-32999-RCE-on-Comet-Server-via-branding-configuration",
      "source": "[email protected]"
    }
  ]
}