Cohesity operates a focused data-protection and backup platform alongside associated management and agent components, positioned prominently in enterprise infrastructure for data resilience and recovery workflows. The recurring vulnerability surface centers on authentication and privilege-boundary issues—improper certificate validation, OS command injection, insecure defaults, and privilege-escalation weaknesses—reflecting the administrative trust and command-execution scope inherent to backup and recovery systems. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Cohesity over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-28123CRITICAL Undocumented Default Cryptographic Key Vulnerability in Cohesity DataPlatform version 6.3 prior 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6.5.1b. The ssh key can provide an attack | Apr 2, 2021 | 9.8 | 30 | NO | NO |
CVE-2025-63909HIGH Incorrect access control in the component /opt/SRLtzm/bin/TapeDumper of Cohesity TranZman Migration Appliance Release 4.0 Build 14614 allows attackers to escalate privileges to roo | Mar 3, 2026 | 7.8 | 25 | NO | NO |
CVE-2019-11242HIGH A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity clusters did not verify TLS certificate | Jul 12, 2019 | 8.1 | 25 | NO | NO |
CVE-2025-67840HIGH Multiple authenticated OS command injection vulnerabilities exist in the Cohesity (formerly Stone Ram) TranZman 4.0 Build 14614 through TZM_1757588060_SEP2025_FULL.depot web applic | Mar 3, 2026 | 7.2 | 24 | NO | NO |
CVE-2025-63912HIGH Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to use a weak cryptography algorithm for data encryption, allowing attackers to trivially reverse the e | Mar 3, 2026 | 7.5 | 24 | NO | NO |
CVE-2025-63911HIGH Cohesity TranZman Migration Appliance Release 4.0 Build 14614 was discovered to contain an authenticated command injection vulnerability. | Mar 3, 2026 | 7.2 | 24 | NO | NO |
CVE-2021-36795HIGH A permission issue in the Cohesity Linux agent may allow privilege escalation in version 6.5.1b to 6.5.1d-hotfix10, 6.6.0a to 6.6.0b-hotfix1. An underprivileged linux user, if cert | Aug 6, 2021 | 7.8 | 24 | NO | NO |
CVE-2025-63910HIGH An authenticated arbitrary file upload vulnerability in Cohesity TranZman Migration Appliance Release 4.0 Build 14614 allows attackers with Administrator privileges to execute arbi | Mar 3, 2026 | 7.2 | 23 | NO | NO |
CVE-2023-33295MEDIUM Cohesity DataProtect prior to 6.8.1_u5 or 7.1 was discovered to have a incorrect access control vulnerability due to a lack of TLS Certificate Validation. | Jan 19, 2024 | 6.5 | 21 | NO | NO |
CVE-2021-28124MEDIUM A man-in-the-middle vulnerability in Cohesity DataPlatform support channel in version 6.3 up to 6.3.1g, 6.4 up to 6.4.1c and 6.5.1 through 6.5.1b. Missing server authentication in | Apr 2, 2021 | 5.9 | 20 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Cohesity.
Media articles that mention a CVE ID that affects a product developed by Cohesity — matched by CVE ID, not by vendor name.