CVE-2022-36955: 
Veritas NetBackup Client vulnerability analysis and mitigation

A privilege escalation vulnerability (CVE-2022-36955) was discovered in Veritas NetBackup that affects multiple versions including 8.0 through 8.1.2, 8.2, 8.3 through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1. The vulnerability was disclosed on July 27, 2022, allowing an attacker with unprivileged local access to a NetBackup Client to send specific commands to escalate their privileges (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attack vector is Local, requiring low attack complexity with no privileges required. The vulnerability affects the client component of Veritas NetBackup software (Veritas Advisory).

If successfully exploited, this vulnerability allows an attacker to escalate their privileges on the affected system, potentially gaining high levels of access to confidentiality, integrity, and availability of the system (Veritas Advisory).

Veritas has released multiple mitigation paths depending on the version: upgrade to NetBackup Client 10.0 (no HotFix needed), upgrade to 9.1.0.1 and apply VTS22-008 HotFix, upgrade to 9.0.0.1 and apply VTS22-008 HotFix, upgrade to 8.3.0.2 and apply VTS22-008 HotFix, or apply specific version HotFixes for 8.2 and 8.1.2 clients (Veritas Advisory).