Authorization bypass in Commvault CommServe command execution (CVE-2026-13738)

CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. The flaw carries a CVSS score of 9.2 (Critical) and could allow unauthorized command execution on affected installations. All Commvault components - including Commserve, Webserver, Command Center, Media Agents, Clients, and HyperScale X - must be updated to the resolved maintenance release. Affected versions: - 11.46.0 - 11.46.9 - 11.44.0 - 11.44.10 - 11.40.0 - 11.40.62 - 11.36.0 - 11.36.113 We recommend updating to: 11.46.10 and above, 11.44.11 and above, 11.40.63 and above, 11.36.114 and above. CVSS 9.2 · our assessment: act_now Reference: https://documentation.commvault.com/securityadvisories/CV_2026_07_9.html Details: https://vuln.today/cve/CVE-2026-13738