LiveActive security incident?Get immediate response
CVE Record

CVE-2022-36955: In Veritas NetBackup, an attacker with unprivileged local access to a NetBackup Client may send specific co...

In Veritas NetBackup, an attacker with unprivileged local access to a NetBackup Client may send specific commands to escalate their privileges. This affects 8.0 through 8.1.2, 8.2, 8.3 through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This is a local privilege escalation issue in Veritas NetBackup Client. Someone who can already access a client host with low privileges may be able to gain higher privileges, risking backup data, host integrity, and recovery operations.

Executive priority

Address in the normal high-severity patch cycle, with expedited handling for backup infrastructure and multi-user hosts. This is not confirmed as actively exploited in the provided sources, but compromise could undermine recovery trust.

Technical view

CVE-2022-36955 affects Veritas NetBackup Client versions 8.0 through 8.1.2, 8.2, 8.3 through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1. CVSS 3.1 is 7.8 with local attack vector, low complexity, user interaction required, and high confidentiality, integrity, and availability impact.

Likely exposure

Exposure is limited to systems running affected Veritas NetBackup Client versions. The attacker needs local access to a client host, so shared servers, admin workstations, and systems with many local users deserve priority review.

Exploitation context

The bundle does not show CISA KEV listing or other evidence of active exploitation. It describes privilege escalation after local access, not remote compromise. Treat this as a post-access risk that can worsen incidents on backup-connected hosts.

Researcher notes

The source bundle lacks CWE, root-cause detail, platform scope, and explicit fixed-build information. Use the CVE record and Veritas advisory as authoritative starting points, and avoid assuming exploit availability or remediation specifics beyond vendor guidance.

Mitigation direction

  • Inventory NetBackup Client installations and versions across servers and workstations.
  • Check Veritas VTS22-008 Issue 2 for fixed versions and supported remediation.
  • Prioritize affected clients on critical infrastructure and backup administration systems.
  • Restrict unnecessary local access to hosts running affected NetBackup Clients.
  • Monitor vendor guidance for any updated workarounds or release notes.

Validation and detection

  • Compare installed NetBackup Client versions against the affected ranges in the CVE record.
  • Confirm whether each exposed host has untrusted or broad local user access.
  • Review Veritas advisory VTS22-008 Issue 2 before declaring remediation complete.
  • Check endpoint and NetBackup logs for unusual local privilege or service activity.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-36955 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:R

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:R1.85.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2022-36955Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:R

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.