High severity · published Feb 24, 2026
CVE-2025-9120
RCE vulnerability has been discovered in OpenText™ Carbonite Safe Server Backup.
8.6
CVSS
0.2%
EPSS
No
On KEV
Description
Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Carbonite Safe Server Backup allows Code Injection.
The vulnerability could be exploited through an open port, potentially allowing unauthorized access.
This issue affects Carbonite Safe Server Backup: through 6.8.3.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Carbonite Safe Server Backup · OpenText™
through 6.8.3 · source: vendor