CVE-2026-32999Disclosure

MEDIUMCVSS 9.0 · CRITICAL

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code on behalf of a privileged user on the affected server and connected devices.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

https://support.cometbackup.com/hc/en-us/articles/40655100268439--CVE-2026-32999-RCE-on-Comet-Server-via-branding-configuration

Weakness type (CWE)

CWE-94

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
5 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 5 signals
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 1d ago at 3 mentions (2026-05-28); latest day: 2
5 total mentions across 2 days

Deep dive

Activity timeline5 mentions / 2d

Signal classification3 categories

Disclosure

360.0%

Active Exploitation

120.0%

Patch

120.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-28	3	Active Exploitation1Disclosure2
2026-05-31	2	Disclosure1Patch1

Full discourse5 posts

Gray Hats@the_yellow_fall134d
Patch
A critical Comet Backup RCE vulnerability has been found. Learn about the CVE-2026-32999 patch released to secure backup servers and user data. #Cybersecurity #CometBackup #RCE #Vulnerability #ServerSecurity https://securityonline.info/comet-backup-rce-vulnerability-cve-2026-32999/ https://t.co/CE55lwSFPa
Post summary
The post announces a critical RCE vulnerability in Comet Backup (CVE‑2026‑32999) and informs readers that a patch has been released to secure backup servers and user data.
02050545
12.5K followersView on X
yousukezan@yousukezan134d
Disclosure
Comet Backupで、サーバー乗っ取りにつながる重大なリモートコード実行脆弱性CVE-2026-32999が公表された。この脆弱性は26.4.3および26.5.0未満のバージョンに存在し、テナント管理者が悪意のあるDLLやSOファイルをアップロードすることで任意コードを実行できる。これによりテナント分離を突破し、サーバー全体を制御される恐れがある。攻撃者は設定ファイル内の認証情報やバックアップデータへアクセスできるほか、サーバーの停止や削除、接続先端末での権限付きコード実行も可能となる。ベンダーは修正版を公開済みで、ホスティング版は対応済み。セルフホスト環境の利用者には26.4.3または26.5.0以降への速やかな更新が推奨されている。 https://securityonline.info/comet-backup-rce-vulnerability-cve-2026-32999/
Post summary
CVE‑2026‑32999 is a critical remote code execution flaw in Comet Backup versions 26.4.3 and older, allowing tenant admins to upload malicious DLL or SO files and break tenant isolation. The vendor has released a patch and advises all self‑hosted users to upgrade immediately.
000211.4K
14.1K followersView on X
ADK Cyber@ADKCyber136d
Disclosure
New high-severity CVE-2026-32999 (CVSS 9.0) in Comet Backup server. MSPs and organizations using Comet should assess exposure and apply updates. https://nvd.nist.gov/vuln/detail/CVE-2026-32999 http://adkcyber.com via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/5aBNt5jyqd
Post summary
The tweet announces the high‑severity CVE‑2026‑32999 affecting Comet Backup server, urges users to assess exposure and apply updates, but provides no evidence of exploitation or PoC.
0000045
81 followersView on X
𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 ℍ𝕒𝕔𝕜𝕥𝕚𝕧𝕚𝕤𝕥☭⃠🅇@YourAnon_irc136d
Active Exploitation
Recent critical CVEs (e.g., CVE-2026-4408, CVE-2026-32999) with active exploits threaten network security, risking data privacy and integrity in transit. Immediate patching is vital. #Cybersecurity #ZeroDay #News
Post summary
The post alerts that CVE-2026-4408 and CVE-2026-32999 are currently being exploited, posing serious network security risks, and urges immediate patching.
0000071
14 followersView on X
Upwind Security MDR@UpwindMDR137d
Disclosure
🚨 Critical - Comet Backup Remote Code Execution via Branding Configuration (CVE-2026-32999) A tenant administrator with branding permissions could achieve remote code execution on the Comet Backup server by uploading malicious .dll / .so files through branding configuration and generating a backup-tool client. Successful exploitation may allow access to configuration files, backed-up data, connected devices, and full takeover of the Comet Server instance. 👉 Affected: Comet Backup versions prior to 26.4.3 / 26.5.0 👉 Fix: Upgrade to Comet Backup 26.4.3, 26.5.0 or later
Post summary
The post details CVE-2026-32999 as a remote code execution flaw in Comet Backup, provides technical specifics, and recommends upgrading to patched versions.
0000066
196 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-32999

yousukezan[verified]@yousukezanDisclosure

CVE‑2026‑32999 is a critical remote code execution flaw in Comet Backup versions 26.4.3 and older, allowing tenant admins to upload malicious DLL or SO files and break tenant isolation. The vendor has released a patch and advises all self‑hosted users to upgrade immediately.

ADK Cyber[verified]@ADKCyberDisclosure

The tweet announces the high‑severity CVE‑2026‑32999 affecting Comet Backup server, urges users to assess exposure and apply updates, but provides no evidence of exploitation or PoC.

Upwind Security MDR[verified]@UpwindMDRDisclosure

The post details CVE-2026-32999 as a remote code execution flaw in Comet Backup, provides technical specifics, and recommends upgrading to patched versions.

Gray Hats@the_yellow_fallPatch

The post announces a critical RCE vulnerability in Comet Backup (CVE‑2026‑32999) and informs readers that a patch has been released to secure backup servers and user data.

𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 ℍ𝕒𝕔𝕜𝕥𝕚𝕧𝕚𝕤𝕥☭⃠🅇@YourAnon_ircActive Exploitation

The post alerts that CVE-2026-4408 and CVE-2026-32999 are currently being exploited, posing serious network security risks, and urges immediate patching.