PT-2026-22772 · Cohesity · Cohesity Tranzman

Published 2026-03-03 · Updated 2026-03-05 · CVE-2025-67840

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cohesity TranZman versions 4.0 Build 14614 through TZM 1757588060 SEP2025 FULL.depot

Description The software contains authenticated OS command injection flaws in its web application API endpoints, including the Scheduler and Actions pages. The appliance concatenates user-controlled parameters into system commands without proper sanitisation, enabling an authenticated administrator to inject and execute arbitrary OS commands with root privileges. An attacker can modify parameters in legitimate requests, such as those during job creation or execution, using a proxy to include shell metacharacters, leading to remote code execution on the appliance. This bypasses the CLISH restricted shell confinement, resulting in full system compromise. The issue persists even with the latest patch available as of the time of testing, TZM 1757588060 SEP2025 FULL.depot.

Recommendations Versions 4.0 Build 14614 through TZM 1757588060 SEP2025 FULL.depot: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-67840

Affected Products

Cohesity Tranzman

References · 8

• 🔥 https://github.com/GregDurys/Cohesity-TranZman-CVEs · Exploit
• 🔥 https://gist.github.com/GregDurys/ef7fc6a36646df927374bba8e7279270 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-67840 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67840 · Vendor Advisory
• https://t.me/CVEtracker/46234 · Telegram Post
• https://t.me/cveNotify/154240 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2028926789624397848 · Twitter Post
• https://cohesity.com · Note