CVE-2025-67840 - Vulnerability Analysis

Overview

Cohesity TranZman 4.0 Build 14614 through TZM_1757588060_SEP2025_FULL.depot contains authenticated OS command injection caused by unsanitized user parameters in API endpoints, letting authenticated admin users execute arbitrary commands as root, exploit requires admin authentication.

Severity & Score

Impact

Authenticated admin users can execute arbitrary OS commands as root, leading to full system compromise.

Mitigation

Update to a fixed version beyond 4.0 Build 14614 or apply vendor patches when available.

References

• https://cohesity.com
• https://gist.github.com/GregDurys/ef7fc6a36646df927374bba8e7279270
• https://github.com/GregDurys/Cohesity-TranZman-CVEs

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner