Vulnerability intelligence

CVE-2026-32999

Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices.

CVSS Score

9.1

Critical

EPSS — Exploit Probability

0.3%

Riskier than 23% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

unknown

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered May 31, 2026 · latest May 31, 2026

Coverage timeline

Critical CVE-2026-32999 flaw in Comet Backup permits remote code
securityonline.info · May 31, 2026