Refine your search
24 vulnerabilities found for Commvault Cloud by Commvault
CVE-2026-97334 (GCVE-0-2026-97334)
Vulnerability from cvelistv5
Published
2026-10-13 14:27
Modified
2026-10-13 14:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97334",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T14:40:07.536505Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:40:43.295Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:01.613Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_3.html"
}
],
"title": "Network messaging layer decompression resource exhaustion"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-97334",
"datePublished": "2026-10-13T14:27:01.613Z",
"dateReserved": "2026-09-24T12:01:47.252Z",
"dateUpdated": "2026-10-13T14:40:43.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97333 (GCVE-0-2026-97333)
Vulnerability from cvelistv5
Published
2026-10-13 14:27
Modified
2026-10-13 14:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97333",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T14:40:22.875942Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:40:58.939Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:01.385Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_4.html"
}
],
"title": "QAPI stack-based buffer overflow"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-97333",
"datePublished": "2026-10-13T14:27:01.385Z",
"dateReserved": "2026-09-24T12:01:45.453Z",
"dateUpdated": "2026-10-13T14:40:58.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77100 (GCVE-0-2026-77100)
Vulnerability from cvelistv5
Published
2026-10-13 14:27
Modified
2026-10-13 14:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77100",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T14:41:16.105259Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:41:29.578Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:01.168Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_6.html"
}
],
"title": "MediaAgent Denial of Service"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77100",
"datePublished": "2026-10-13T14:27:01.168Z",
"dateReserved": "2026-08-20T10:57:52.110Z",
"dateUpdated": "2026-10-13T14:41:29.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77099 (GCVE-0-2026-77099)
Vulnerability from cvelistv5
Published
2026-10-13 14:27
Modified
2026-10-14 03:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77099",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T03:59:44.212Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Grid(HSX) CVFS",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "5.0.14.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.14.4",
"status": "affected",
"version": "5.0.1.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:00.935Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_9.html"
}
],
"title": "CVFS Command Execution"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77099",
"datePublished": "2026-10-13T14:27:00.935Z",
"dateReserved": "2026-08-20T10:56:58.071Z",
"dateUpdated": "2026-10-14T03:59:44.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77096 (GCVE-0-2026-77096)
Vulnerability from cvelistv5
Published
2026-10-13 14:27
Modified
2026-10-14 18:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77096",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:51:49.537219Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:52:11.875Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.40",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.39",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Grid(HSX) CVFS",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "5.0.14.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.14.4",
"status": "affected",
"version": "5.0.1.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:00.698Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_7.html"
}
],
"title": "CVFS Missing Authentication"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77096",
"datePublished": "2026-10-13T14:27:00.698Z",
"dateReserved": "2026-08-20T10:56:58.071Z",
"dateUpdated": "2026-10-14T18:52:11.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77095 (GCVE-0-2026-77095)
Vulnerability from cvelistv5
Published
2026-10-13 14:27
Modified
2026-10-14 18:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77095",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:52:32.293104Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:52:53.868Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:00.403Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_5.html"
}
],
"title": "CvFWD Null Pointer Dereference"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77095",
"datePublished": "2026-10-13T14:27:00.403Z",
"dateReserved": "2026-08-20T10:56:58.071Z",
"dateUpdated": "2026-10-14T18:52:53.868Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77094 (GCVE-0-2026-77094)
Vulnerability from cvelistv5
Published
2026-10-13 14:27
Modified
2026-10-14 18:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77094",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:53:28.173537Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:53:48.467Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-787: Out-of-bounds Write",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:00.178Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_1.html"
}
],
"title": "CvFWD Out-of-Bounds Write"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77094",
"datePublished": "2026-10-13T14:27:00.178Z",
"dateReserved": "2026-08-20T10:56:58.071Z",
"dateUpdated": "2026-10-14T18:53:48.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77093 (GCVE-0-2026-77093)
Vulnerability from cvelistv5
Published
2026-10-13 14:26
Modified
2026-10-14 18:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77093",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:54:10.202546Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:54:26.527Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale"
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:26:59.902Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_2.html"
}
],
"title": "CvFWD Denial of Service"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77093",
"datePublished": "2026-10-13T14:26:59.902Z",
"dateReserved": "2026-08-20T10:56:58.070Z",
"dateUpdated": "2026-10-14T18:54:26.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77090 (GCVE-0-2026-77090)
Vulnerability from cvelistv5
Published
2026-10-13 14:26
Modified
2026-10-14 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77090",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:55:24.747642Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:55:53.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Grid(HSX) CVFS",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "5.0.14.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.14.4",
"status": "affected",
"version": "5.0.1.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-611: Improper Restriction of XML External Entity Reference",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:26:59.619Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_4.html"
}
],
"title": "CVFS Information Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77090",
"datePublished": "2026-10-13T14:26:59.619Z",
"dateReserved": "2026-08-20T10:56:58.070Z",
"dateUpdated": "2026-10-14T18:55:53.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18228 (GCVE-0-2026-18228)
Vulnerability from cvelistv5
Published
2026-10-13 14:26
Modified
2026-10-14 18:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18228",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:56:21.699640Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:56:42.209Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Thomas Pianezzola"
}
],
"descriptions": [
{
"lang": "en",
"value": "HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:26:59.335Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_8.html"
}
],
"title": "Hyperscale Path Traversal"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-18228",
"datePublished": "2026-10-13T14:26:59.335Z",
"dateReserved": "2026-07-29T11:49:22.558Z",
"dateUpdated": "2026-10-14T18:56:42.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77106 (GCVE-0-2026-77106)
Vulnerability from cvelistv5
Published
2026-09-08 12:12
Modified
2026-09-09 04:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77106",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T04:26:08.110Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862: Missing Authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:15:44.123Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_08_8.html"
}
],
"title": "Cvlaunchd Code Execution"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77106",
"datePublished": "2026-09-08T12:12:55.097Z",
"dateReserved": "2026-08-20T10:58:04.239Z",
"dateUpdated": "2026-09-09T04:26:08.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77105 (GCVE-0-2026-77105)
Vulnerability from cvelistv5
Published
2026-09-08 12:12
Modified
2026-09-09 04:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77105",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T04:26:06.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:54.826Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_08_7.html"
}
],
"title": "CommServe Privilege Escalation"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77105",
"datePublished": "2026-09-08T12:12:54.826Z",
"dateReserved": "2026-08-20T10:58:02.223Z",
"dateUpdated": "2026-09-09T04:26:06.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77104 (GCVE-0-2026-77104)
Vulnerability from cvelistv5
Published
2026-09-08 12:12
Modified
2026-09-08 13:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77104",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:23:30.381204Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:25:55.269Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:54.620Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_08_6.html"
}
],
"title": "CommServe Path Traversal"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77104",
"datePublished": "2026-09-08T12:12:54.620Z",
"dateReserved": "2026-08-20T10:57:52.110Z",
"dateUpdated": "2026-09-08T13:25:55.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77103 (GCVE-0-2026-77103)
Vulnerability from cvelistv5
Published
2026-09-08 12:12
Modified
2026-09-08 13:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77103",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:23:49.319206Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:25:38.622Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:54.437Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_08_5.html"
}
],
"title": "CommServe Information Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77103",
"datePublished": "2026-09-08T12:12:54.437Z",
"dateReserved": "2026-08-20T10:57:52.110Z",
"dateUpdated": "2026-09-08T13:25:38.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77102 (GCVE-0-2026-77102)
Vulnerability from cvelistv5
Published
2026-09-08 12:12
Modified
2026-09-08 13:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77102",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:24:19.978501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:25:21.705Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:54.281Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_08_4.html"
}
],
"title": "CommServe Denial of Service"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77102",
"datePublished": "2026-09-08T12:12:54.281Z",
"dateReserved": "2026-08-20T10:57:52.110Z",
"dateUpdated": "2026-09-08T13:25:21.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77101 (GCVE-0-2026-77101)
Vulnerability from cvelistv5
Published
2026-09-08 12:12
Modified
2026-09-08 13:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77101",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:24:30.911215Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:24:56.965Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:54.122Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_08_3.html"
}
],
"title": "CommServe Stack-based Buffer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77101",
"datePublished": "2026-09-08T12:12:54.122Z",
"dateReserved": "2026-08-20T10:57:52.110Z",
"dateUpdated": "2026-09-08T13:24:56.965Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77098 (GCVE-0-2026-77098)
Vulnerability from cvelistv5
Published
2026-09-08 12:12
Modified
2026-09-08 13:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77098",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:27:02.935632Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:27:30.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:53.928Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_08_2.html"
}
],
"title": "Private Metrics Server SQL Injection"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77098",
"datePublished": "2026-09-08T12:12:53.928Z",
"dateReserved": "2026-08-20T10:56:58.071Z",
"dateUpdated": "2026-09-08T13:27:30.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77097 (GCVE-0-2026-77097)
Vulnerability from cvelistv5
Published
2026-09-08 12:12
Modified
2026-09-08 13:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77097",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:30:12.896266Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:30:17.822Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:53.765Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_08_1.html"
}
],
"title": "Private Metrics Server Denial of Service"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77097",
"datePublished": "2026-09-08T12:12:53.765Z",
"dateReserved": "2026-08-20T10:56:58.071Z",
"dateUpdated": "2026-09-08T13:30:17.822Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77092 (GCVE-0-2026-77092)
Vulnerability from cvelistv5
Published
2026-09-08 12:12
Modified
2026-09-08 13:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77092",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:34:22.105440Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:34:25.246Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:53.589Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_6.html"
}
],
"title": "Content Extractor Privilege Escalation"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77092",
"datePublished": "2026-09-08T12:12:53.589Z",
"dateReserved": "2026-08-20T10:56:58.070Z",
"dateUpdated": "2026-09-08T13:34:25.246Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77091 (GCVE-0-2026-77091)
Vulnerability from cvelistv5
Published
2026-09-08 12:12
Modified
2026-09-08 13:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77091",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:33:48.703147Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:33:54.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:53.432Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_3.html"
}
],
"title": "DataCube Security Feature Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77091",
"datePublished": "2026-09-08T12:12:53.432Z",
"dateReserved": "2026-08-20T10:56:58.070Z",
"dateUpdated": "2026-09-08T13:33:54.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77089 (GCVE-0-2026-77089)
Vulnerability from cvelistv5
Published
2026-09-08 12:12
Modified
2026-09-09 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77089",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T04:26:06.353164Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T12:34:01.813Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:53.236Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_1.html"
}
],
"title": "Command Center API Authentication Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77089",
"datePublished": "2026-09-08T12:12:53.236Z",
"dateReserved": "2026-08-20T10:56:18.889Z",
"dateUpdated": "2026-09-09T12:34:01.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13738 (GCVE-0-2026-13738)
Vulnerability from cvelistv5
Published
2026-08-11 11:01
Modified
2026-08-11 16:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13738",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T16:48:09.726861Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T16:48:34.748Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.9",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.10",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.63",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.62",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.114",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.113",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-863: Incorrect Authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:01:39.248Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_9.html"
}
],
"title": "Improper Authorization Validation"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-13738",
"datePublished": "2026-08-11T11:01:39.248Z",
"dateReserved": "2026-06-29T14:54:16.684Z",
"dateUpdated": "2026-08-11T16:48:34.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13737 (GCVE-0-2026-13737)
Vulnerability from cvelistv5
Published
2026-08-11 11:01
Modified
2026-08-11 16:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13737",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T16:48:52.032563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T16:49:09.354Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.9",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.10",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.63",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.62",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.114",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.113",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-863: Incorrect Authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:01:38.785Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_8.html"
}
],
"title": "Command Restriction Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-13737",
"datePublished": "2026-08-11T11:01:38.785Z",
"dateReserved": "2026-06-29T14:54:15.451Z",
"dateUpdated": "2026-08-11T16:49:09.354Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13739 (GCVE-0-2026-13739)
Vulnerability from cvelistv5
Published
2026-08-11 11:01
Modified
2026-08-11 14:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Commvault | Commvault Cloud |
Version: 11.46.0 < Version: 11.44.0 < Version: 11.40.0 < Version: 11.36.0 < |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13739",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T14:13:11.777885Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T14:13:35.906Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.9",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.10",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.63",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.62",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.114",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.113",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Peter V., Principal Researcher, CFC Security LTD."
}
],
"descriptions": [
{
"lang": "en",
"value": "A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:01:38.340Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_5.html"
}
],
"title": "Server-Side Request Forgery (SSRF)"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-13739",
"datePublished": "2026-08-11T11:01:38.340Z",
"dateReserved": "2026-06-29T14:54:17.751Z",
"dateUpdated": "2026-08-11T14:13:35.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}