CVE-2026-32999: Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices

Synopsis

An insufficient character filtering vulnerability in the backup agent signing module of Comet Backup server allows an authenticated tenant administrator to inject and execute arbitrary code on behalf of a privileged user. The attack is reachable over the network, requires no prior authentication beyond a tenant administrator account, and can spread impact beyond the affected server to connected devices. Successful exploitation gives an attacker full control over the server and connected backup clients, including the ability to read, modify, or destroy all data handled by the service. Patched-image rebuilds at versions 26.4.3 and 26.5.0 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Comet Backup server's signing module over the network; the service must be exposed to the attacker's network path.

• AuthenticationNot required

  No pre-existing account is required to begin the attack; the CVE vector specifies PR:N, meaning privilege escalation originates from publicly accessible tenant administrator provisioning rather than a credential the attacker must already hold. Note: the vulnerability description states the attacker acts as an authenticated tenant administrator, so gaining that role is part of the attack path.

• Victim interactionNot required

  No user action or social engineering is needed; exploitation is fully attacker-driven with no required victim interaction (UI:N).

• Attack complexityDetail

  Attack complexity is rated High (AC:H), meaning the attacker must navigate specific environmental conditions or timing constraints, such as particular server state or configuration, rather than launching a simple, always-reliable exploit.

Blast Radius

• The attacker executes arbitrary code in the context of a privileged user on the Comet Backup server, gaining full command execution over the host.
• Confidentiality impact is High: the attacker reads backup data, stored credentials, configuration secrets, and any customer records accessible to the privileged process.
• Integrity impact is High: the attacker modifies or poisons backup archives, agent configurations, and persisted server data on the affected host.
• Availability impact is High with scope change (S:C): the attacker can crash or disable the backup server and disrupt connected backup agent devices, taking down backup coverage for all tenants on the affected instance.