CVE-2025-67840 Command injection in n/a

High 7.2 Published 3 Mar 2026 Updated 3 Mar 2026

Authenticated admins can inject OS commands via API parameters to achieve root-level remote code execution, bypassing shell restrictions.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-67840?

CVE-2025-67840 is a high-severity command injection vulnerability in n/a, published on 3 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Multiple authenticated OS command injection vulnerabilities exist in the Cohesity (formerly Stone Ram) TranZman 4.0 Build 14614 through TZM_1757588060_SEP2025_FULL.depot web application API endpoints (including Scheduler and Actions pages). The appliance directly concatenates user-controlled parameters into system commands without sufficient sanitisation, allowing an authenticated admin user to inject and execute arbitrary OS commands with root privileges. An attacker can intercept legitimate requests (e.g. during job creation or execution) using a proxy and modify parameters to include shell metacharacters, achieving remote code execution on the appliance. This completely bypasses the intended CLISH restricted shell confinement and results in full system compromise. The vulnerabilities persist in Release 4.0 Build 14614 including the latest patch (as of the time of testing) TZM_1757588060_SEP2025_FULL.depot.

Weakness: CWE-78

Which versions are affected by CVE-2025-67840?

It affects 1 product.

Products include Cohesity Tranzman.

How do I fix CVE-2025-67840?

No fix has been published for CVE-2025-67840 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-67840 being exploited?

There is no known exploitation of CVE-2025-67840 in the wild and no public exploit code.

Sources

Also known as GHSA-j46m-h6wf-3gc4.