EUVD-2026-56000
GHSA-xxcx-v673-pwpr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network SSRF; high confidentiality impact from internal service exposure; low integrity and availability per 4.0 base; no scope change.
Primary rating from Vendor (Commvault).
CVSS VectorVendor: Commvault
Lifecycle Timeline
2DescriptionCVE.org
A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.
AnalysisAI
Unauthenticated server-side request forgery in Commvault Command Center's legacy endpoint allows a remote, unauthenticated attacker to cause the server to issue HTTP requests to arbitrary URLs, exposing internal services, cloud metadata endpoints, and credentials accessible from the Command Center's privileged network position. All versions of Commvault Cloud are indicated as affected per wildcard CPE, with Commvault releasing a resolved maintenance release per advisory CV_2026_07_5. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the CVSS 4.0 score of 8.8 with no authentication or precondition requirements makes this a high-priority remediation target in enterprise environments.
Technical ContextAI
Commvault Command Center is the centralized web-based management console for Commvault's enterprise backup and data protection platform. The vulnerable legacy endpoint accepts user-supplied target URLs and initiates outbound HTTP requests server-side without validating or restricting the destination - the canonical Server-Side Request Forgery (SSRF) pattern, typically aligned with CWE-918, though no CWE was formally assigned in NVD data. SSRF in an enterprise backup management plane is particularly impactful because Command Center frequently has trusted network access to storage targets, backup agents, internal APIs, and - in cloud deployments - instance metadata services such as AWS IMDSv1 (169.254.169.254), which can yield temporary IAM credentials. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N) confirms the endpoint is reachable over the network with no authentication, no complexity, and no attack technique prerequisites, resulting in high confidentiality impact to the vulnerable system itself.
RemediationAI
Commvault has released a resolved maintenance release for Command Center addressing this vulnerability; customers should upgrade to the patched version as described in advisory CV_2026_07_5 at https://documentation.commvault.com/securityadvisories/CV_2026_07_5.html. The exact fixed version number is not disclosed in available NVD or CPE data and must be retrieved directly from the Commvault advisory. As a compensating control until patching is complete, restrict outbound (egress) network access from the Command Center host to explicitly whitelisted backup infrastructure, blocking outbound connections to RFC-1918 ranges not required for backup operations and to cloud metadata endpoints such as 169.254.169.254 - note that overly broad egress blocks may interrupt legitimate backup workflows and should be validated in a non-production environment first. Additionally, enforce strict network perimeter controls to ensure Command Center is not exposed to untrusted networks or the public internet.
Commvault Command Center Innovation Release allows unauthenticated remote code execution through path traversal in ZIP f
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access thr
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments
In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, D
During the brief window between installation and the first administrator login, remote attackers may exploit the default
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted seri
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privileg
Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operati
Authorization bypass in Commvault CommServe permits attackers to circumvent the command-execution allowlist, gaining uns
Unauthenticated access to the Private Metrics Server component in Commvault Cloud allows network-adjacent or internet-fa
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today