CommvaultSecurityIQ Integration CVE-2026-0274

Exploitation requires that the target Cortex XSOAR or Cortex XSIAM tenant has the CommvaultSecurityIQ marketplace integration installed and enabled, and that the attacker has network reachability to the tenant endpoint serving the integration. Limiting factors: the bug only affects deployments that actively use the Commvault integration pack (not stock Cortex XSOAR/XSIAM installs), exposure is constrained to the network paths reaching tenant APIs, and exploitation is bounded to the resources the integration itself manages rather than the full Cortex platform (SC:N/SI:N/SA:N indicates no subsequent-system impact).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) indicates a network-reachable, low-complexity, unauthenticated path with high impact to the vulnerable system, which on paper is a high-priority issue; however, the threat-intelligence sub-vector E:U (exploit maturity Unproven), the absence from CISA KEV, the lack of a public PoC, and the limited deployment surface (only environments that have installed and configured the CommvaultSecurityIQ integration) substantially lower realistic risk. The reporter is Palo Alto Networks itself, suggesting vendor-coordinated disclosure rather than active in-the-wild exploitation. No EPSS score was supplied in the input, and SSVC decision data is not provided, so prioritization rests on the CVSS vector and the narrow exposure of the affected integration; treat as a meaningful but targeted risk for SOCs running Commvault-Cortex integration in production.

A remote attacker who can reach the Cortex XSOAR or XSIAM tenant endpoints hosting the CommvaultSecurityIQ integration sends crafted requests that bypass credential validation, then queries or modifies Commvault-managed resources such as backup job metadata, retention policies, or stored secrets. Because the issue requires no authentication and no user interaction, exploitation could be scripted, but no public exploit identified at time of analysis limits opportunistic abuse to actors with their own research.