CVE-2022-36986: 
Veritas NetBackup Client vulnerability analysis and mitigation

A critical security vulnerability (CVE-2022-36986) was discovered in Veritas NetBackup versions 8.1.x through 9.1.x, affecting NetBackup Primary servers. The vulnerability was disclosed on July 27, 2022, and allows an attacker with unauthenticated access to remotely execute arbitrary commands on a NetBackup Primary server (Veritas Advisory).

The vulnerability is classified as High severity with a CVSS v3.1 Base Score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H). This remote code execution vulnerability requires no authentication or user interaction, making it particularly dangerous. The attack vector is network-accessible and has low attack complexity (Veritas Advisory).

If successfully exploited, this vulnerability allows attackers to execute arbitrary commands on a NetBackup Primary server without requiring authentication. This could potentially lead to complete system compromise and significant service disruption (Veritas Advisory).

Veritas has released HotFixes for affected versions including NetBackup 8.1.2, 8.2, 8.3.0.1, 8.3.0.2, 9.0.0.1, and 9.1.0.1. Organizations running versions prior to 8.1.2 are advised to upgrade to a newer version and apply the appropriate NetBackup HotFix. The fix should be applied to both Primary servers and Media servers for complete protection (Veritas Advisory).