Search
Find a vulnerability
Search criteria
6 vulnerabilities found for Grid(HSX) CVFS by Commvault
CVE-2026-77099 (GCVE-0-2026-77099)
Vulnerability from nvd – Published: 2026-10-13 14:27 – Updated: 2026-10-14 03:59
VLAI
EPSS
VEX
Title
CVFS Command Execution
Summary
CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.29
(custom)
Affected: 11.44.0 , ≤ 11.44.24 (custom) Affected: 11.40.0 , ≤ 11.40.77 (custom) Affected: 11.36.0 , ≤ 11.36.126 (custom) |
|
| Commvault | Grid(HSX) CVFS |
Affected:
5.0.1.0 , ≤ 5.0.14.4
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77099",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T03:59:44.212Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Grid(HSX) CVFS",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "5.0.14.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.14.4",
"status": "affected",
"version": "5.0.1.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:00.935Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_9.html"
}
],
"title": "CVFS Command Execution"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77099",
"datePublished": "2026-10-13T14:27:00.935Z",
"dateReserved": "2026-08-20T10:56:58.071Z",
"dateUpdated": "2026-10-14T03:59:44.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77096 (GCVE-0-2026-77096)
Vulnerability from nvd – Published: 2026-10-13 14:27 – Updated: 2026-10-13 14:27
VLAI
EPSS
VEX
Title
CVFS Missing Authentication
Summary
CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
Severity
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.39
(custom)
Affected: 11.44.0 , ≤ 11.44.24 (custom) Affected: 11.40.0 , ≤ 11.40.77 (custom) Affected: 11.36.0 , ≤ 11.36.126 (custom) |
|
| Commvault | Grid(HSX) CVFS |
Affected:
5.0.1.0 , ≤ 5.0.14.4
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.40",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.39",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Grid(HSX) CVFS",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "5.0.14.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.14.4",
"status": "affected",
"version": "5.0.1.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:00.698Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_7.html"
}
],
"title": "CVFS Missing Authentication"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77096",
"datePublished": "2026-10-13T14:27:00.698Z",
"dateReserved": "2026-08-20T10:56:58.071Z",
"dateUpdated": "2026-10-13T14:27:00.698Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77090 (GCVE-0-2026-77090)
Vulnerability from nvd – Published: 2026-10-13 14:26 – Updated: 2026-10-13 14:26
VLAI
EPSS
VEX
Title
CVFS Information Disclosure
Summary
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.
Severity
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.29
(custom)
Affected: 11.44.0 , ≤ 11.44.24 (custom) Affected: 11.40.0 , ≤ 11.40.77 (custom) Affected: 11.36.0 , ≤ 11.36.126 (custom) |
|
| Commvault | Grid(HSX) CVFS |
Affected:
5.0.1.0 , ≤ 5.0.14.4
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Grid(HSX) CVFS",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "5.0.14.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.14.4",
"status": "affected",
"version": "5.0.1.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-611: Improper Restriction of XML External Entity Reference",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:26:59.619Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_4.html"
}
],
"title": "CVFS Information Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77090",
"datePublished": "2026-10-13T14:26:59.619Z",
"dateReserved": "2026-08-20T10:56:58.070Z",
"dateUpdated": "2026-10-13T14:26:59.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77099 (GCVE-0-2026-77099)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:27 – Updated: 2026-10-14 03:59
VLAI
EPSS
VEX
Title
CVFS Command Execution
Summary
CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.29
(custom)
Affected: 11.44.0 , ≤ 11.44.24 (custom) Affected: 11.40.0 , ≤ 11.40.77 (custom) Affected: 11.36.0 , ≤ 11.36.126 (custom) |
|
| Commvault | Grid(HSX) CVFS |
Affected:
5.0.1.0 , ≤ 5.0.14.4
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77099",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T03:59:44.212Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Grid(HSX) CVFS",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "5.0.14.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.14.4",
"status": "affected",
"version": "5.0.1.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:00.935Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_9.html"
}
],
"title": "CVFS Command Execution"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77099",
"datePublished": "2026-10-13T14:27:00.935Z",
"dateReserved": "2026-08-20T10:56:58.071Z",
"dateUpdated": "2026-10-14T03:59:44.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77096 (GCVE-0-2026-77096)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:27 – Updated: 2026-10-13 14:27
VLAI
EPSS
VEX
Title
CVFS Missing Authentication
Summary
CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
Severity
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.39
(custom)
Affected: 11.44.0 , ≤ 11.44.24 (custom) Affected: 11.40.0 , ≤ 11.40.77 (custom) Affected: 11.36.0 , ≤ 11.36.126 (custom) |
|
| Commvault | Grid(HSX) CVFS |
Affected:
5.0.1.0 , ≤ 5.0.14.4
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.40",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.39",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Grid(HSX) CVFS",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "5.0.14.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.14.4",
"status": "affected",
"version": "5.0.1.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:27:00.698Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_7.html"
}
],
"title": "CVFS Missing Authentication"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77096",
"datePublished": "2026-10-13T14:27:00.698Z",
"dateReserved": "2026-08-20T10:56:58.071Z",
"dateUpdated": "2026-10-13T14:27:00.698Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77090 (GCVE-0-2026-77090)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:26 – Updated: 2026-10-13 14:26
VLAI
EPSS
VEX
Title
CVFS Information Disclosure
Summary
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.
Severity
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Commvault | Commvault Cloud |
Affected:
11.46.0 , ≤ 11.46.29
(custom)
Affected: 11.44.0 , ≤ 11.44.24 (custom) Affected: 11.40.0 , ≤ 11.40.77 (custom) Affected: 11.36.0 , ≤ 11.36.126 (custom) |
|
| Commvault | Grid(HSX) CVFS |
Affected:
5.0.1.0 , ≤ 5.0.14.4
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Commvault Cloud",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "11.46.30",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.46.29",
"status": "affected",
"version": "11.46.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.44.25",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.44.24",
"status": "affected",
"version": "11.44.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.40.78",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.40.77",
"status": "affected",
"version": "11.40.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.36.127",
"status": "unaffected"
}
],
"lessThanOrEqual": "11.36.126",
"status": "affected",
"version": "11.36.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"platforms": [
"Linux"
],
"product": "Grid(HSX) CVFS",
"vendor": "Commvault",
"versions": [
{
"changes": [
{
"at": "5.0.14.5",
"status": "unaffected"
}
],
"lessThanOrEqual": "5.0.14.4",
"status": "affected",
"version": "5.0.1.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."
}
],
"descriptions": [
{
"lang": "en",
"value": "CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-611: Improper Restriction of XML External Entity Reference",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:26:59.619Z",
"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"shortName": "Commvault"
},
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_4.html"
}
],
"title": "CVFS Information Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"assignerShortName": "Commvault",
"cveId": "CVE-2026-77090",
"datePublished": "2026-10-13T14:26:59.619Z",
"dateReserved": "2026-08-20T10:56:58.070Z",
"dateUpdated": "2026-10-13T14:26:59.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}