Command restriction bypass in Commvault CommServe (CVE-2026-13737)

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. The flaw is rated Critical (CVSS 9.2) and could allow unauthorized command execution by circumventing authorization controls. Software customers must upgrade to a resolved maintenance release and update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients, and HyperScale X. Affected versions: - 11.46.0 - 11.46.9 - 11.44.0 - 11.44.10 - 11.40.0 - 11.40.62 - 11.36.0 - 11.36.113 We recommend updating to: 11.46.10 and above, 11.44.11 and above, 11.40.63 and above, 11.36.114 and above. CVSS 9.2 · our assessment: act_now Reference: https://documentation.commvault.com/securityadvisories/CV_2026_07_8.html Details: https://vuln.today/cve/CVE-2026-13737