Commvault CommServe CVE-2026-13737

Exploitation requires network reachability to the CommServe command-execution/authorization interface and the ability to craft requests that defeat its allowlist check for command execution; per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are required. Limiting factors: the vendor's high attack complexity rating (AC:H) signals that reliable exploitation depends on specific conditions or is not straightforward, and exposure is bounded to environments where the CommServe management interface is reachable by the attacker rather than isolated on a trusted administrative network.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.2 critical: network-reachable and unauthenticated (PR:N/UI:N) with high impact to confidentiality, integrity and availability of the vulnerable system, but tempered by high attack complexity (AC:H), implying the bypass is not trivially reproducible and may require specific conditions or timing. No EPSS score, SSVC decision, or POC signal was provided, and the CVE is not in CISA KEV - so there is no evidence of active exploitation and no probabilistic exploitation estimate to weigh. The net picture is a high-priority patching item because of the critical impact and unauthenticated network vector on a security-critical backup controller, balanced against AC:H and the absence of any observed exploitation or public exploit. Missing data (EPSS, CWE, exact fixed version) should be treated as unknowns, not as reassurance.

A network-positioned attacker who can reach the CommServe service crafts requests that evade the command-execution allowlist, causing CommServe to run commands it should have denied. Leveraging CommServe's central role, the attacker pivots to manipulate backups or connected agents across the environment. No public exploit code is known, and the CVSS AC:H rating implies the bypass requires non-trivial effort or specific conditions to trigger reliably.