Multiple authenticated OS command injection vulnerabilities exist in Cohesity TranZman 4.0 Build 14614 through latest patch TZM_1757588060_SEP2025_FULL.depot. The web application API endpoints directly concatenate user-controlled parameters into system commands without proper sanitization. Authenticated admin users can inject arbitrary OS commands with root privileges by intercepting requests and modifying parameters with shell metacharacters. This bypasses CLISH restricted shell confinement and results in complete system compromise including remote code execution.