Security readout for executives and security teams
Plain-English summary
This vulnerability affects Veritas NetBackup Primary servers in several 8.x and 9.x releases. An unauthenticated attacker with network access could remotely execute arbitrary commands. For executives, this is high urgency because backup infrastructure is operationally sensitive and often trusted across recovery workflows.
Executive priority
Treat this as a high-priority backup-platform risk. Backup systems are critical during outages and ransomware response, and unauthenticated remote command execution on a Primary server can threaten recovery operations even without confirmed active exploitation.
Technical view
CVE-2022-36986 is a network-accessible, unauthenticated command execution issue in Veritas NetBackup 8.1.x through 9.1.0.1 and related products. The supplied CVSS 3.1 score is 8.6 High, with low attack complexity, no privileges, no user interaction, changed scope, and high availability impact.
Likely exposure
Exposure is likely limited to organizations running the listed Veritas NetBackup versions or related NetBackup products, especially where a Primary server is reachable by untrusted networks. The supplied bundle does not identify CPEs or specific related products.
Exploitation context
The source bundle does not support active exploitation: KEV is false and no cited source states exploitation in the wild. The issue is still serious because the described attacker requires no authentication and only network access to the Primary server.
Researcher notes
Evidence is strong for affected version ranges and unauthenticated remote command execution, but incomplete for exact patches, CPEs, and related product scope in the supplied bundle. Avoid assuming exploitation status or remediation details beyond Veritas advisory VTS22-004.
Mitigation direction
- Review Veritas advisory VTS22-004 for affected products and supported fixes.
- Upgrade or apply Veritas-supported remediation for all affected NetBackup Primary servers.
- Restrict network access to NetBackup Primary servers to trusted administrative and service paths.
- Increase monitoring around NetBackup Primary server process, authentication, and administrative activity.
- Prioritize exposed or internet-adjacent backup infrastructure before isolated systems.
Validation and detection
- Inventory NetBackup Primary server versions against the affected 8.1.x, 8.2, 8.3.x, 9.x, and 9.1.x ranges.
- Confirm whether any related NetBackup products are covered by Veritas advisory VTS22-004.
- Verify network paths to Primary servers from untrusted or lower-trust segments.
- Confirm remediation status using vendor-supported version and patch evidence.
- Review logs for unusual command execution or service behavior around Primary servers.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-36986 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:C/UI:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:C/UI:N3.94Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:C/UI:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.veritas.com/content/support/en_US/security/VTS22-004#h3CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.