CVE-2026-32999CWE-94

Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code…

Critical · published May 28, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
40.3
In the wild
Unconfirmed
What it is

Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00478 · 40.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-05-28T04:01Z
EPSS history
Timeline
  • 28 MAY 04:01Z
    Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code…
    cvelistv5