Rubrik provides data management and backup solutions centered on its Cohesity Data Management (CDM) platform and cloud data management offerings, which handle sensitive backup and recovery operations across enterprise environments. The vendor's disclosed vulnerabilities center on input-handling and access-control issues—including buffer overflows, improper access control, certificate validation weaknesses, and OS command injection—that reflect the attack surface inherent to backup appliances handling privileged credentials and restoration workflows. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Rubrik over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-36068CRITICAL An incorrect access control vulnerability in Rubrik CDM versions prior to 9.1.2-p1, 9.0.3-p6 and 8.1.3-p12, allows an attacker with network access to execute arbitrary code. | Aug 27, 2024 | 9.8 | 28 | NO | NO |
CVE-2020-9478HIGH An issue was discovered in Rubrik 5.0.3-2296. An OS command injection vulnerability allows an authenticated attacker to remotely execute arbitrary code on Rubrik-managed systems. | Apr 13, 2020 | 8.8 | 28 | NO | NO |
CVE-2022-30984HIGH A buffer overflow vulnerability in the Rubrik Backup Service (RBS) Agent for Linux or Unix-based systems in Rubrik CDM 7.0.1, 7.0.1-p1, 7.0.1-p2 or 7.0.1-p3 before CDM 7.0.2-p2 cou | Aug 26, 2022 | 7.8 | 27 | NO | NO |
CVE-2018-5761HIGH A man-in-the-middle vulnerability related to vCenter access was found in Rubrik CDM 3.x and 4.x before 4.0.4-p2. This vulnerability might expose Rubrik user credentials configured | Jan 22, 2018 | 8.1 | 24 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Rubrik.
Media articles that mention a CVE ID that affects a product developed by Rubrik — matched by CVE ID, not by vendor name.