VulnerabilityAnalyzed

CVE-2025-67840

HIGH 7.2EPSS 3.83%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (3.83%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Multiple authenticated OS command injection vulnerabilities exist in the Cohesity (formerly Stone Ram) TranZman 4.0 Build 14614 through TZM_1757588060_SEP2025_FULL.depot web application API endpoints (including Scheduler and Actions pages). The appliance directly concatenates user-controlled parameters into system commands without sufficient sanitisation, allowing an authenticated admin user to inject and execute arbitrary OS commands with root privileges. An attacker can intercept legitimate requests (e.g. during job creation or execution) using a proxy and modify parameters to include shell metacharacters, achieving remote code execution on the appliance. This completely bypasses the intended CLISH restricted shell confinement and results in full system compromise. The vulnerabilities persist in Release 4.0 Build 14614 including the latest patch (as of the time of testing) TZM_1757588060_SEP2025_FULL.depot.

CVSS 3.1: 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 3.83% probability · 90th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-78
Affected: cohesity/tranzman
Source: cve@mitre.org

EPSS trend

EPSS 3.8% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

https://cohesity.comProduct
https://gist.github.com/GregDurys/ef7fc6a36646df927374bba8e7279270Exploit, Third Party Advisory
https://github.com/GregDurys/Cohesity-TranZman-CVEsThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.