CVE-2026-32999: Critical Code Execution in Comet Backup Server Signing Module

Technical summary

The vulnerability exists in the backup agent signing module of Comet Backup server due to inadequate character validation (CWE-94: Improper Control of Generation of Code). When processing signing requests, the system fails to properly sanitize input, allowing an authenticated tenant administrator to inject malicious code that executes in a privileged context. The attack does not require user interaction and can propagate to connected backup clients, significantly broadening the blast radius from a single compromised account.

Business impact

Exploitation of this vulnerability can result in complete compromise of a backup infrastructure. An insider threat or compromised tenant admin account becomes a vector for lateral movement across an organization's entire backup ecosystem. This directly endangers data confidentiality, integrity, and availability—the core functions backup systems are meant to protect. Recovery from such an incident would be severely complicated, as the backup infrastructure itself cannot be trusted as a recovery source until remediated.

Affected systems

Comet Backup server installations are affected. The vulnerability requires authentication (tenant administrator role), so it is primarily a risk to organizations using Comet Backup where user access controls are not sufficiently restrictive or where admin credentials are exposed. Connected backup clients and devices that trust the compromised server are equally at risk.

Exploitability

Exploitation requires valid tenant administrator credentials and network access to the Comet Backup server. While the attack vector is network-based, the moderate complexity suggests that successful exploitation depends on specific conditions or configuration—likely related to how the signing module processes and interprets input. The lack of current KEV status does not diminish the severity; the CVSS 9.0 rating reflects high impact potential across confidentiality, integrity, and availability with cross-boundary scope.

Remediation

Organizations must prioritize patching Comet Backup server instances. Review and restrict tenant administrator role assignments to essential personnel only. Consider implementing network segmentation to limit lateral movement from a compromised admin account. Audit backup agent signing logs for anomalous activity post-deployment of any patches. Verify patch application across all connected clients to ensure consistent security posture.

Patch guidance

Apply the vendor-provided security patch for Comet Backup server immediately. Verify the patch against the official Comet Backup advisory for correct version numbers and compatibility. Test patching in a non-production environment first to ensure backup operations remain stable. Schedule patching during a maintenance window to minimize service disruption, and confirm that all connected backup clients can successfully communicate with the patched server post-update.

Detection guidance

Monitor backup agent signing module logs for unusual character sequences or encoding anomalies in signing requests from tenant administrator accounts. Look for unexpected code execution or spawned processes originating from backup server processes. Check for lateral movement or privilege escalation attempts following backup agent deployments. Implement alerting on changes to backup agent binaries or unexpected modifications to signed artifacts.

Why prioritize this

Despite not appearing on the KEV catalog, this vulnerability merits immediate attention due to its CRITICAL severity rating (CVSS 9.0), cross-boundary scope, and the privileged nature of the backup infrastructure it affects. The combination of high impact (confidentiality, integrity, availability all affected) and the authenticated attack vector makes this a significant insider-threat and compromised-credential risk. Backup systems are high-value targets, and their compromise cascades risk across the entire organization.

Risk score, explained

The CVSS 3.1 score of 9.0 reflects a network-accessible vulnerability with high impact across all three security pillars (CIA), broad scope (affects both server and connected systems), and moderate attack complexity. While authentication is required, the tenant administrator role represents a significant trust boundary within multi-tenant backup environments. The cross-boundary impact (scope change) elevates the risk substantially, as a single compromised credential can compromise downstream systems.

Frequently asked questions