Search
Find a vulnerability
Search criteria
25 vulnerabilities
CVE-2026-97334 (GCVE-0-2026-97334)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:27 – Updated: 2026-10-13 14:40
VLAI
EPSS
VEX
Title
Network messaging layer decompression resource exhaustion
Summary
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 14:40 UTC
CWE
- CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.29
(custom)
Affected: 11.44.0 , ≤ 11.44.24 (custom) Affected: 11.40.0 , ≤ 11.40.77 (custom) Affected: 11.36.0 , ≤ 11.36.126 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97334",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T14:40:07.536505Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:40:43.295Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:01.613Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_3.html"
}
],
"title": "Network messaging layer decompression resource exhaustion"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-97334",
"datePublished": "2026-10-13T14:27:01.613Z",
"dateReserved": "2026-09-24T12:01:47.252Z",
"dateUpdated": "2026-10-13T14:40:43.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97333 (GCVE-0-2026-97333)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:27 – Updated: 2026-10-13 14:40
VLAI
EPSS
VEX
Title
QAPI stack-based buffer overflow
Summary
QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 14:40 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.29
(custom)
Affected: 11.44.0 , ≤ 11.44.24 (custom) Affected: 11.40.0 , ≤ 11.40.77 (custom) Affected: 11.36.0 , ≤ 11.36.126 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97333",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T14:40:22.875942Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:40:58.939Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:01.385Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_4.html"
}
],
"title": "QAPI stack-based buffer overflow"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-97333",
"datePublished": "2026-10-13T14:27:01.385Z",
"dateReserved": "2026-09-24T12:01:45.453Z",
"dateUpdated": "2026-10-13T14:40:58.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77100 (GCVE-0-2026-77100)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:27 – Updated: 2026-10-13 14:41
VLAI
EPSS
VEX
Title
MediaAgent Denial of Service
Summary
MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 14:41 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.29
(custom)
Affected: 11.44.0 , ≤ 11.44.24 (custom) Affected: 11.40.0 , ≤ 11.40.77 (custom) Affected: 11.36.0 , ≤ 11.36.126 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77100",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T14:41:16.105259Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:41:29.578Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:01.168Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_6.html"
}
],
"title": "MediaAgent Denial of Service"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77100",
"datePublished": "2026-10-13T14:27:01.168Z",
"dateReserved": "2026-08-20T10:57:52.110Z",
"dateUpdated": "2026-10-13T14:41:29.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77099 (GCVE-0-2026-77099)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:27 – Updated: 2026-10-14 03:59
VLAI
EPSS
VEX
Title
CVFS Command Execution
Summary
CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.29
(custom)
Affected: 11.44.0 , ≤ 11.44.24 (custom) Affected: 11.40.0 , ≤ 11.40.77 (custom) Affected: 11.36.0 , ≤ 11.36.126 (custom) |
|
| Commvault | Grid(HSX) CVFS |
Affected:
5.0.1.0 , ≤ 5.0.14.4
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77099",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T03:59:44.212Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Grid(HSX) CVFS",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "5.0.14.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.14.4",
"status": "affected",
"version": "5.0.1.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:00.935Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_9.html"
}
],
"title": "CVFS Command Execution"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77099",
"datePublished": "2026-10-13T14:27:00.935Z",
"dateReserved": "2026-08-20T10:56:58.071Z",
"dateUpdated": "2026-10-14T03:59:44.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77096 (GCVE-0-2026-77096)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:27 – Updated: 2026-10-14 18:52
VLAI
EPSS
VEX
Title
CVFS Missing Authentication
Summary
CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 18:51 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.39
(custom)
Affected: 11.44.0 , ≤ 11.44.24 (custom) Affected: 11.40.0 , ≤ 11.40.77 (custom) Affected: 11.36.0 , ≤ 11.36.126 (custom) |
|
| Commvault | Grid(HSX) CVFS |
Affected:
5.0.1.0 , ≤ 5.0.14.4
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77096",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:51:49.537219Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:52:11.875Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.40",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.39",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Grid(HSX) CVFS",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "5.0.14.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.14.4",
"status": "affected",
"version": "5.0.1.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:00.698Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_7.html"
}
],
"title": "CVFS Missing Authentication"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77096",
"datePublished": "2026-10-13T14:27:00.698Z",
"dateReserved": "2026-08-20T10:56:58.071Z",
"dateUpdated": "2026-10-14T18:52:11.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77095 (GCVE-0-2026-77095)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:27 – Updated: 2026-10-14 18:52
VLAI
EPSS
VEX
Title
CvFWD Null Pointer Dereference
Summary
CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 18:52 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.29
(custom)
Affected: 11.44.0 , ≤ 11.44.24 (custom) Affected: 11.40.0 , ≤ 11.40.77 (custom) Affected: 11.36.0 , ≤ 11.36.126 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77095",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:52:32.293104Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:52:53.868Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:00.403Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_5.html"
}
],
"title": "CvFWD Null Pointer Dereference"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77095",
"datePublished": "2026-10-13T14:27:00.403Z",
"dateReserved": "2026-08-20T10:56:58.071Z",
"dateUpdated": "2026-10-14T18:52:53.868Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77094 (GCVE-0-2026-77094)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:27 – Updated: 2026-10-14 18:53
VLAI
EPSS
VEX
Title
CvFWD Out-of-Bounds Write
Summary
CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 18:53 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.29
(custom)
Affected: 11.44.0 , ≤ 11.44.24 (custom) Affected: 11.40.0 , ≤ 11.40.77 (custom) Affected: 11.36.0 , ≤ 11.36.126 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77094",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:53:28.173537Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:53:48.467Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-787: Out-of-bounds Write",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:00.178Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_1.html"
}
],
"title": "CvFWD Out-of-Bounds Write"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77094",
"datePublished": "2026-10-13T14:27:00.178Z",
"dateReserved": "2026-08-20T10:56:58.071Z",
"dateUpdated": "2026-10-14T18:53:48.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77093 (GCVE-0-2026-77093)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:26 – Updated: 2026-10-14 18:54
VLAI
EPSS
VEX
Title
CvFWD Denial of Service
Summary
CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 18:54 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.29
(custom)
Affected: 11.44.0 , ≤ 11.44.24 (custom) Affected: 11.40.0 , ≤ 11.40.77 (custom) Affected: 11.36.0 , ≤ 11.36.126 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77093",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:54:10.202546Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:54:26.527Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale"
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:26:59.902Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_2.html"
}
],
"title": "CvFWD Denial of Service"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77093",
"datePublished": "2026-10-13T14:26:59.902Z",
"dateReserved": "2026-08-20T10:56:58.070Z",
"dateUpdated": "2026-10-14T18:54:26.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77090 (GCVE-0-2026-77090)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:26 – Updated: 2026-10-14 18:55
VLAI
EPSS
VEX
Title
CVFS Information Disclosure
Summary
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 18:55 UTC
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.29
(custom)
Affected: 11.44.0 , ≤ 11.44.24 (custom) Affected: 11.40.0 , ≤ 11.40.77 (custom) Affected: 11.36.0 , ≤ 11.36.126 (custom) |
|
| Commvault | Grid(HSX) CVFS |
Affected:
5.0.1.0 , ≤ 5.0.14.4
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77090",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:55:24.747642Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:55:53.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Grid(HSX) CVFS",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "5.0.14.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.14.4",
"status": "affected",
"version": "5.0.1.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-611: Improper Restriction of XML External Entity Reference",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:26:59.619Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_4.html"
}
],
"title": "CVFS Information Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77090",
"datePublished": "2026-10-13T14:26:59.619Z",
"dateReserved": "2026-08-20T10:56:58.070Z",
"dateUpdated": "2026-10-14T18:55:53.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18228 (GCVE-0-2026-18228)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:26 – Updated: 2026-10-14 18:56
VLAI
EPSS
VEX
Title
Hyperscale Path Traversal
Summary
HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 18:56 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.29
(custom)
Affected: 11.44.0 , ≤ 11.44.24 (custom) Affected: 11.40.0 , ≤ 11.40.77 (custom) Affected: 11.36.0 , ≤ 11.36.126 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18228",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:56:21.699640Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:56:42.209Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Thomas Pianezzola"
}
],
"descriptions": [
{
"lang": "en",
"value": "HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:26:59.335Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_8.html"
}
],
"title": "Hyperscale Path Traversal"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-18228",
"datePublished": "2026-10-13T14:26:59.335Z",
"dateReserved": "2026-07-29T11:49:22.558Z",
"dateUpdated": "2026-10-14T18:56:42.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77106 (GCVE-0-2026-77106)
Vulnerability from cvelistv5 – Published: 2026-09-08 12:12 – Updated: 2026-09-09 04:26
VLAI
EPSS
VEX
Title
Cvlaunchd Code Execution
Summary
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 00:00 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.19
(custom)
Affected: 11.44.0 , ≤ 11.44.19 (custom) Affected: 11.40.0 , ≤ 11.40.71 (custom) Affected: 11.36.0 , ≤ 11.36.122 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77106",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T04:26:08.110Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862: Missing Authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:15:44.123Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_08_8.html"
}
],
"title": "Cvlaunchd Code Execution"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77106",
"datePublished": "2026-09-08T12:12:55.097Z",
"dateReserved": "2026-08-20T10:58:04.239Z",
"dateUpdated": "2026-09-09T04:26:08.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77105 (GCVE-0-2026-77105)
Vulnerability from cvelistv5 – Published: 2026-09-08 12:12 – Updated: 2026-09-09 04:26
VLAI
EPSS
VEX
Title
CommServe Privilege Escalation
Summary
CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 00:00 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.19
(custom)
Affected: 11.44.0 , ≤ 11.44.19 (custom) Affected: 11.40.0 , ≤ 11.40.71 (custom) Affected: 11.36.0 , ≤ 11.36.122 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77105",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T04:26:06.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:54.826Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_08_7.html"
}
],
"title": "CommServe Privilege Escalation"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77105",
"datePublished": "2026-09-08T12:12:54.826Z",
"dateReserved": "2026-08-20T10:58:02.223Z",
"dateUpdated": "2026-09-09T04:26:06.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77104 (GCVE-0-2026-77104)
Vulnerability from cvelistv5 – Published: 2026-09-08 12:12 – Updated: 2026-09-08 13:25
VLAI
EPSS
VEX
Title
CommServe Path Traversal
Summary
CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:23 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.19
(custom)
Affected: 11.44.0 , ≤ 11.44.19 (custom) Affected: 11.40.0 , ≤ 11.40.71 (custom) Affected: 11.36.0 , ≤ 11.36.122 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77104",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:23:30.381204Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:25:55.269Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:54.620Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_08_6.html"
}
],
"title": "CommServe Path Traversal"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77104",
"datePublished": "2026-09-08T12:12:54.620Z",
"dateReserved": "2026-08-20T10:57:52.110Z",
"dateUpdated": "2026-09-08T13:25:55.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77103 (GCVE-0-2026-77103)
Vulnerability from cvelistv5 – Published: 2026-09-08 12:12 – Updated: 2026-09-08 13:25
VLAI
EPSS
VEX
Title
CommServe Information Disclosure
Summary
CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:23 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.19
(custom)
Affected: 11.44.0 , ≤ 11.44.19 (custom) Affected: 11.40.0 , ≤ 11.40.71 (custom) Affected: 11.36.0 , ≤ 11.36.122 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77103",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:23:49.319206Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:25:38.622Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:54.437Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_08_5.html"
}
],
"title": "CommServe Information Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77103",
"datePublished": "2026-09-08T12:12:54.437Z",
"dateReserved": "2026-08-20T10:57:52.110Z",
"dateUpdated": "2026-09-08T13:25:38.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77102 (GCVE-0-2026-77102)
Vulnerability from cvelistv5 – Published: 2026-09-08 12:12 – Updated: 2026-09-08 13:25
VLAI
EPSS
VEX
Title
CommServe Denial of Service
Summary
CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:24 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.19
(custom)
Affected: 11.44.0 , ≤ 11.44.19 (custom) Affected: 11.40.0 , ≤ 11.40.71 (custom) Affected: 11.36.0 , ≤ 11.36.122 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77102",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:24:19.978501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:25:21.705Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:54.281Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_08_4.html"
}
],
"title": "CommServe Denial of Service"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77102",
"datePublished": "2026-09-08T12:12:54.281Z",
"dateReserved": "2026-08-20T10:57:52.110Z",
"dateUpdated": "2026-09-08T13:25:21.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77101 (GCVE-0-2026-77101)
Vulnerability from cvelistv5 – Published: 2026-09-08 12:12 – Updated: 2026-09-08 13:24
VLAI
EPSS
VEX
Title
CommServe Stack-based Buffer Overflow
Summary
CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:24 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.19
(custom)
Affected: 11.44.0 , ≤ 11.44.19 (custom) Affected: 11.40.0 , ≤ 11.40.71 (custom) Affected: 11.36.0 , ≤ 11.36.122 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77101",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:24:30.911215Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:24:56.965Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:54.122Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_08_3.html"
}
],
"title": "CommServe Stack-based Buffer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77101",
"datePublished": "2026-09-08T12:12:54.122Z",
"dateReserved": "2026-08-20T10:57:52.110Z",
"dateUpdated": "2026-09-08T13:24:56.965Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77098 (GCVE-0-2026-77098)
Vulnerability from cvelistv5 – Published: 2026-09-08 12:12 – Updated: 2026-09-08 13:27
VLAI
EPSS
VEX
Title
Private Metrics Server SQL Injection
Summary
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:27 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.19
(custom)
Affected: 11.44.0 , ≤ 11.44.19 (custom) Affected: 11.40.0 , ≤ 11.40.71 (custom) Affected: 11.36.0 , ≤ 11.36.122 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77098",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:27:02.935632Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:27:30.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:53.928Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_08_2.html"
}
],
"title": "Private Metrics Server SQL Injection"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77098",
"datePublished": "2026-09-08T12:12:53.928Z",
"dateReserved": "2026-08-20T10:56:58.071Z",
"dateUpdated": "2026-09-08T13:27:30.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77097 (GCVE-0-2026-77097)
Vulnerability from cvelistv5 – Published: 2026-09-08 12:12 – Updated: 2026-09-08 13:30
VLAI
EPSS
VEX
Title
Private Metrics Server Denial of Service
Summary
Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:30 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.19
(custom)
Affected: 11.44.0 , ≤ 11.44.19 (custom) Affected: 11.40.0 , ≤ 11.40.71 (custom) Affected: 11.36.0 , ≤ 11.36.122 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77097",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:30:12.896266Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:30:17.822Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:53.765Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_08_1.html"
}
],
"title": "Private Metrics Server Denial of Service"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77097",
"datePublished": "2026-09-08T12:12:53.765Z",
"dateReserved": "2026-08-20T10:56:58.071Z",
"dateUpdated": "2026-09-08T13:30:17.822Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77092 (GCVE-0-2026-77092)
Vulnerability from cvelistv5 – Published: 2026-09-08 12:12 – Updated: 2026-09-08 13:34
VLAI
EPSS
VEX
Title
Content Extractor Privilege Escalation
Summary
Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:34 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.19
(custom)
Affected: 11.44.0 , ≤ 11.44.19 (custom) Affected: 11.40.0 , ≤ 11.40.71 (custom) Affected: 11.36.0 , ≤ 11.36.122 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77092",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:34:22.105440Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:34:25.246Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:53.589Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_6.html"
}
],
"title": "Content Extractor Privilege Escalation"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77092",
"datePublished": "2026-09-08T12:12:53.589Z",
"dateReserved": "2026-08-20T10:56:58.070Z",
"dateUpdated": "2026-09-08T13:34:25.246Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77091 (GCVE-0-2026-77091)
Vulnerability from cvelistv5 – Published: 2026-09-08 12:12 – Updated: 2026-09-08 13:33
VLAI
EPSS
VEX
Title
DataCube Security Feature Bypass
Summary
DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:33 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.19
(custom)
Affected: 11.44.0 , ≤ 11.44.19 (custom) Affected: 11.40.0 , ≤ 11.40.71 (custom) Affected: 11.36.0 , ≤ 11.36.122 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77091",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:33:48.703147Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:33:54.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:53.432Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_3.html"
}
],
"title": "DataCube Security Feature Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77091",
"datePublished": "2026-09-08T12:12:53.432Z",
"dateReserved": "2026-08-20T10:56:58.070Z",
"dateUpdated": "2026-09-08T13:33:54.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77089 (GCVE-0-2026-77089)
Vulnerability from cvelistv5 – Published: 2026-09-08 12:12 – Updated: 2026-09-09 12:34
VLAI
EPSS
VEX
Title
Command Center API Authentication Bypass
Summary
Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 04:26 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.19
(custom)
Affected: 11.44.0 , ≤ 11.44.19 (custom) Affected: 11.40.0 , ≤ 11.40.71 (custom) Affected: 11.36.0 , ≤ 11.36.122 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77089",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T04:26:06.353164Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T12:34:01.813Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.19",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.20",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.19",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.72",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.71",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.123",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.122",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T12:12:53.236Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_1.html"
}
],
"title": "Command Center API Authentication Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77089",
"datePublished": "2026-09-08T12:12:53.236Z",
"dateReserved": "2026-08-20T10:56:18.889Z",
"dateUpdated": "2026-09-09T12:34:01.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13738 (GCVE-0-2026-13738)
Vulnerability from cvelistv5 – Published: 2026-08-11 11:01 – Updated: 2026-08-11 16:48
VLAI
EPSS
VEX
Title
Improper Authorization Validation
Summary
CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 16:48 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.9
(custom)
Affected: 11.44.0 , ≤ 11.44.10 (custom) Affected: 11.40.0 , ≤ 11.40.62 (custom) Affected: 11.36.0 , ≤ 11.36.113 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13738",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T16:48:09.726861Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T16:48:34.748Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.9",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.10",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.63",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.62",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.114",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.113",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-863: Incorrect Authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:01:39.248Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_9.html"
}
],
"title": "Improper Authorization Validation"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-13738",
"datePublished": "2026-08-11T11:01:39.248Z",
"dateReserved": "2026-06-29T14:54:16.684Z",
"dateUpdated": "2026-08-11T16:48:34.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13737 (GCVE-0-2026-13737)
Vulnerability from cvelistv5 – Published: 2026-08-11 11:01 – Updated: 2026-08-11 16:49
VLAI
EPSS
VEX
Title
Command Restriction Bypass
Summary
CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 16:48 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.9
(custom)
Affected: 11.44.0 , ≤ 11.44.10 (custom) Affected: 11.40.0 , ≤ 11.40.62 (custom) Affected: 11.36.0 , ≤ 11.36.113 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13737",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T16:48:52.032563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T16:49:09.354Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.9",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.10",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.63",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.62",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.114",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.113",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-863: Incorrect Authorization",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:01:38.785Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_8.html"
}
],
"title": "Command Restriction Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-13737",
"datePublished": "2026-08-11T11:01:38.785Z",
"dateReserved": "2026-06-29T14:54:15.451Z",
"dateUpdated": "2026-08-11T16:49:09.354Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13739 (GCVE-0-2026-13739)
Vulnerability from cvelistv5 – Published: 2026-08-11 11:01 – Updated: 2026-08-11 14:13
VLAI
EPSS
VEX
Title
Server-Side Request Forgery (SSRF)
Summary
A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 14:13 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.9
(custom)
Affected: 11.44.0 , ≤ 11.44.10 (custom) Affected: 11.40.0 , ≤ 11.40.62 (custom) Affected: 11.36.0 , ≤ 11.36.113 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13739",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T14:13:11.777885Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T14:13:35.906Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.10",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.9",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.11",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.10",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.63",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.62",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.114",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.113",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Peter V., Principal Researcher, CFC Security LTD."
}
],
"descriptions": [
{
"lang": "en",
"value": "A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T11:01:38.340Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_5.html"
}
],
"title": "Server-Side Request Forgery (SSRF)"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-13739",
"datePublished": "2026-08-11T11:01:38.340Z",
"dateReserved": "2026-06-29T14:54:17.751Z",
"dateUpdated": "2026-08-11T14:13:35.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12776 (GCVE-0-2025-12776)
Vulnerability from cvelistv5 – Published: 2026-01-07 22:03 – Updated: 2026-01-08 18:17
VLAI
EPSS
VEX
Title
Stored Cross-Site Scripting
Summary
The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting (XSS) attack. Proper management of this functionality helps ensure a secure and seamless user experience. Although the user input is not validated in the report creation, these scripts are not executed when the report is run by end users. The script is executed when the report is modified through the report builder by a user with edit permissions.
The Report Builder is part of the WebConsole. The WebConsole package is currently end of life, and is no longer maintained. We strongly recommend against installing or using it in any production environment. However, if you choose to install it, for example, to access functionality like the Report Builder, it must be deployed within a fully isolated network that has no access to sensitive data or internet connectivity. This is a critical security precaution, as the retired package may contain unpatched vulnerabilities and is no longer supported with updates or fixes.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-08 15:09 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | WebConsole |
Affected:
11.32.0 , ≤ 11.32.*
(semver)
Affected: 11.36.0 , ≤ 11.36.* (semver) Unaffected: 11.40.1 , ≤ 11.40.* (semver) Unaffected: 11.42.1 , ≤ 11.42.* (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12776",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-08T15:09:42.351651Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-08T18:17:45.215Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WebConsole",
"vendor": "Commvault",
"versions": [
{
"lessThanOrEqual": "11.32.*",
"status": "affected",
"version": "11.32.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.36.*",
"status": "affected",
"version": "11.36.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.40.*",
"status": "unaffected",
"version": "11.40.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "11.42.*",
"status": "unaffected",
"version": "11.42.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NCIA researchers"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eThe Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting (XSS) attack. Proper management of this functionality helps ensure a secure and seamless user experience. \u0026nbsp;Although the user input is not validated in the report creation, these scripts are not executed when the report is run by end users. The script is executed when the report is modified through the report builder by a user with edit permissions. \u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThe Report Builder is part of the WebConsole. \u0026nbsp;The WebConsole package is currently end of life, and is no longer maintained. We strongly recommend against installing or using it in any production environment. However, if you choose to install it, for example, to access functionality like the Report Builder, it must be deployed within a fully isolated network that has no access to sensitive data or internet connectivity. This is a critical security precaution, as the retired package may contain unpatched vulnerabilities and is no longer supported with updates or fixes.\u0026nbsp;\u0026nbsp;\u003c/div\u003e\u003cbr\u003e\u003cbr\u003e"
}
],
"value": "The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting (XSS) attack. Proper management of this functionality helps ensure a secure and seamless user experience. \u00a0Although the user input is not validated in the report creation, these scripts are not executed when the report is run by end users. The script is executed when the report is modified through the report builder by a user with edit permissions. \n\n\n\n\nThe Report Builder is part of the WebConsole. \u00a0The WebConsole package is currently end of life, and is no longer maintained. We strongly recommend against installing or using it in any production environment. However, if you choose to install it, for example, to access functionality like the Report Builder, it must be deployed within a fully isolated network that has no access to sensitive data or internet connectivity. This is a critical security precaution, as the retired package may contain unpatched vulnerabilities and is no longer supported with updates or fixes."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 1.8,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-07T22:08:14.195Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2025_06_3.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Stored Cross-Site Scripting",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2025-12776",
"datePublished": "2026-01-07T22:03:05.033Z",
"dateReserved": "2025-11-05T20:18:49.381Z",
"dateUpdated": "2026-01-08T18:17:45.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}