CVE-2022-36988: 
Veritas NetBackup Client vulnerability analysis and mitigation

A high severity vulnerability (CVE-2022-36988) was discovered in Veritas NetBackup affecting versions 8.1.x, 8.2, 8.3.x, 9.0.x, and 9.1.x, along with related NetBackup products including NetBackup Appliance, Flex Appliance, and Flex Scale. The vulnerability was disclosed on July 18, 2022, and involves remote command execution capabilities (Veritas Advisory).

The vulnerability is classified as a remote command execution issue with a CVSS v3.1 Base Score of 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H). An attacker with authenticated access to a NetBackup OpsCenter server, NetBackup Primary server, or NetBackup Media server could remotely execute arbitrary commands on a NetBackup Primary server or NetBackup Media server (Veritas Advisory).

If successfully exploited, this vulnerability allows authenticated attackers to execute arbitrary commands on affected NetBackup Primary servers or Media servers, potentially leading to complete system compromise with high impacts on confidentiality, integrity, and availability (Veritas Advisory).

Veritas has released HotFixes for affected versions including NetBackup 8.1.2, 8.2, 8.3.0.1, 8.3.0.2, 9.0.0.1, and 9.1.0.1. Users are advised to apply the HotFix to both Primary servers and Media servers. For versions prior to 8.1.2, users should upgrade to a newer version and apply the appropriate NetBackup HotFix (Veritas Advisory).