CVE-2022-36985: 
Veritas NetBackup Client vulnerability analysis and mitigation

CVE-2022-36985 is a high-severity vulnerability discovered in Veritas NetBackup affecting versions 8.1.x through 9.1.x, NetBackup Appliance/NetBackup Virtual Appliance, and Flex Appliance/Flex Scale systems. The vulnerability was disclosed on July 27, 2022, and allows an attacker with unprivileged local access to a Windows NetBackup Primary server to potentially escalate their privileges (Veritas Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity. The attack vector is local (AV:L), requires low attack complexity (AC:L), needs low privileges (PR:L), requires no user interaction (UI:N), and has a scope that is unchanged (S:U). The impact includes high confidentiality (C:H), integrity (I:H), and availability (A:H) compromises (Veritas Advisory).

If successfully exploited, this vulnerability allows an attacker to escalate their privileges on a Windows NetBackup Primary server, potentially gaining elevated access to system resources and sensitive data. The high CVSS score reflects the significant potential impact on system security (Veritas Advisory).

Veritas has released hotfixes for affected versions including NetBackup 8.1.2, 8.2, 8.3.0.1, 8.3.0.2, 9.0.0.1, and 9.1.0.1. Users are advised to apply the VTS22-004 HotFix to both Primary servers and Media servers. For systems running versions prior to 8.1.2, users should upgrade to a newer version and apply the appropriate NetBackup Hotfix (Veritas Advisory).