EUVD-2026-56001
GHSA-vpjp-54p7-3qc9
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated allowlist bypass (AV:N/PR:N/UI:N) but non-trivial to trigger (AC:H); command execution yields full C/I/A impact on the CommServe host.
Primary rating from Vendor (Commvault).
CVSS VectorVendor: Commvault
Lifecycle Timeline
2DescriptionCVE.org
CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
AnalysisAI
Authorization bypass in Commvault CommServe permits attackers to circumvent the command-execution allowlist, gaining unsanctioned command execution across the backup-management control plane. Because CommServe orchestrates the entire Commvault environment, a successful bypass can cascade to Webservers, Command Center, Media Agents, Clients and HyperScale X, threatening confidentiality, integrity and availability of protected data. Rated CVSS 4.0 9.2 (critical) by Commvault; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
CommServe is the central management/control server in the Commvault Cloud (formerly Commvault Complete) data-protection platform, coordinating backup, restore and administrative operations for all connected agents and media. The flaw is an allowlist (permit-list) bypass in the component that authorizes which commands may be executed - a Missing/Improper Authorization class weakness (the input lists CWE as N/A, but the behavior maps to CWE-863/CWE-285). By defeating the allowlist check, an actor can invoke commands that the authorization layer was designed to block. The single affected CPE reported is cpe:2.3:a:commvault:commvault_cloud, i.e. the Commvault Cloud product line, though the vendor advisory extends remediation to every installed role.
RemediationAI
Patch available per vendor advisory: upgrade to the resolved Commvault maintenance release as described at https://documentation.commvault.com/securityadvisories/CV_2026_07_8.html, and apply it to every Commvault role - CommServe, Webserver, Command Center, Media Agents, Clients and HyperScale X - since the advisory calls for updating all installations rather than CommServe alone. No exact fixed version number is specified in the provided data, so confirm the current resolved maintenance release directly from the advisory before deployment. As compensating controls until patching completes, restrict network reachability of the CommServe management interfaces to trusted administrative networks/VPN and firewall off exposure to untrusted segments (trade-off: may disrupt remote agent/console connectivity that must then be explicitly re-allowed), and increase monitoring/alerting on CommServe command-execution and authorization logs to detect anomalous or unexpected command invocations (trade-off: detection only, not prevention).
Commvault Command Center Innovation Release allows unauthenticated remote code execution through path traversal in ZIP f
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access thr
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments
In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, D
During the brief window between installation and the first administrator login, remote attackers may exploit the default
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted seri
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privileg
Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operati
Unauthenticated access to the Private Metrics Server component in Commvault Cloud allows network-adjacent or internet-fa
Unauthenticated server-side request forgery in Commvault Command Center's legacy endpoint allows a remote, unauthenticat
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today