CVE-2025-67840

Multiple authenticated OS command injection vulnerabilities exist in the Cohesity (formerly Stone Ram) TranZman 4.0 Build 14614 through TZM_1757588060_SEP2025_FULL.depot web application API endpoints (including Scheduler and Actions pages). The appliance directly concatenates user-controlled parameters into system commands without sufficient sanitisation, allowing an authenticated admin user to inject and execute arbitrary OS commands with root privileges. An attacker can intercept legitimate requests (e.g. during job creation or execution) using a proxy and modify parameters to include shell metacharacters, achieving remote code execution on the appliance. This completely bypasses the intended CLISH restricted shell confinement and results in full system compromise. The vulnerabilities persist in Release 4.0 Build 14614 including the latest patch (as of the time of testing) TZM_1757588060_SEP2025_FULL.depot.

• CWE-78

• https://cohesity.comProduct
• https://gist.github.com/GregDurys/ef7fc6a36646df927374bba8e7279270Exploit, Third Party Advisory
• https://github.com/GregDurys/Cohesity-TranZman-CVEsThird Party Advisory

Published

Mar 3, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6783The GoZen Forms plugin for WordPress is vulnerable to SQL In…7.5
• CVE-2025-67830Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL …9.8
• CVE-2025-67833Paessler PRTG Network Monitor before 25.4.114 allows XSS by …6.1
• CVE-2025-67834Paessler PRTG Network Monitor before 25.4.114 allows XSS by …5.4
• CVE-2025-67835Paessler PRTG Network Monitor before 25.4.114 allows Denial-…6.5
• CVE-2025-6784The Code Engine plugin for WordPress is vulnerable to Remote…8.8
• CVE-2025-67841Nordic Semiconductor IronSide SE for nRF54H20 before 23.0.2+…7.5
• CVE-2025-67842The Static Asset API in Mintlify Platform before 2025-11-15 …5.4
• CVE-2025-67843A Server-Side Template Injection (SSTI) vulnerability in the…9.8
• CVE-2025-67844The GitHub Integration API in Mintlify Platform before 2025-…4.3
• CVE-2025-67845A Directory Traversal vulnerability in the Static Asset Prox…5.4
• CVE-2025-67846The Deployment Infrastructure in Mintlify Platform before 20…6.5