EUVD-2026-98755
GHSA-jxpj-8hjm-976g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege credentials
-
ExploitSend crafted path-traversal request
-
ExecutionRead files outside intended directory
-
ImpactDisclose sensitive backup/config data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged authenticated session to the Commvault HyperScale MediaAgent service (PR:L), after which the path-traversal weakness allows reading files outside the intended directory over the network with no user interaction (UI:N) and low complexity (AC:L). Exploitation is limited by the authentication requirement - anonymous/unauthenticated internet attackers cannot trigger it - making stolen or insider credentials the realistic precondition; impact is confined to confidentiality (file/data disclosure) with no integrity or availability effect. Exact vulnerable deployment modes and whether this applies to Commvault Cloud, on-prem HyperScale MediaAgents, or both should be confirmed against Commvault advisory CV_2026_10_8. |
| Impact | This is a moderate-severity, authenticated information-disclosure flaw rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) shows a network-reachable, low-complexity path traversal that requires low-level privileges (PR:L) and yields high confidentiality impact but no integrity or availability impact - consistent with a 7.1 base score. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization: the risk is driven by the theoretical confidentiality exposure, not by observed in-the-wild activity. The requirement for valid low-privileged authentication meaningfully reduces mass-exploitation risk, pointing to an insider or post-compromise (credential-abuse) threat model rather than opportunistic internet-wide scanning. Note a source inconsistency to verify: the description and product name reference 'HyperScale MediaAgents,' while the only affected CPE is cpe:2.3:a:commvault:commvault_cloud - confirm with the vendor advisory whether on-prem HyperScale MediaAgents, Commvault Cloud, or both are affected. |
| Exploit ScenarioDerived | An attacker holding a low-privileged account (or stolen credentials) on an affected Commvault HyperScale MediaAgent sends a crafted request containing directory-traversal sequences to a file-handling endpoint, causing the service to return files outside the intended directory. This exposes sensitive backup data, configuration, or credential material. No public exploit code was identified in the provided data, and low attack complexity (AC:L) means a working request would be straightforward to construct once the vulnerable parameter is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Path traversal in Commvault HyperScale MediaAgents allows an authenticated low-privileged user to read files outside the intended directory over the network, resulting in unauthorized disclosure of data (rated 7.1, confidentiality-only impact with no integrity or availability effect). The flaw requires a valid session to the MediaAgent service (PR:L per the assessed vector), so anonymous internet attackers cannot trigger it - stolen, shared, or insider credentials are the realistic precondition. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Commvault reports that software customers should upgrade to the resolved maintenance release; exact affected versions and deployment modes should be confirmed against advisory CV_2026_10_8.
RemediationAI
Vendor-released remediation is described in Commvault security advisory CV_2026_10_8: software customers should upgrade to the resolved maintenance release and update the Commvault installation of HyperScale MediaAgents. Patch available per vendor advisory - the source data does not specify an exact fix version number, so retrieve the target build directly from https://documentation.commvault.com/securityadvisories/CV_2026_10_8.html rather than assuming a version, and validate that both the MediaAgent role and any associated Commvault Cloud components are at the corrected level. Because exploitation requires an authenticated low-privileged session, the most effective compensating controls until patching is complete are credential and network scoping rather than perimeter filtering: restrict network reachability of the MediaAgent service ports to trusted backup/management subnets and administrative hosts (trade-off: complicates distributed backup topologies and agent roaming, and may require firewall or jump-host changes), enforce least privilege so that backup operators and service accounts hold only the roles they need (trade-off: may break delegated job administration), and rotate or revoke credentials for any accounts that could reach the handler, since stolen or insider credentials are the realistic attack precondition. Add detection for anomalous reads of files outside expected backup and staging directories by MediaAgent processes, understanding that such monitoring only shortens dwell time and does not prevent disclosure on its own.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a path traversal (directory traversal) weakness affecting the file-handling logic of Commvault HyperScale's MediaAgent component, a data-mover/backup proxy role within the Commvault data protection platform that is commonly exposed to backup networks and sometimes to wider network segments for agent and cloud communication. Input supplied to the MediaAgent is not sufficiently constrained before being resolved to a filesystem path, so a crafted request can reference files outside the intended directory and return their contents - a classic CWE-22 class defect, although no CWE was formally assigned in the supplied data. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) both characterize this as a network-reachable, low-complexity, authenticated confidentiality breach with no scope change and no integrity or availability impact. The supplied CPE (cpe:2.3:a:commvault:commvault_cloud:*:*:*:*:*:*:*:*) uses a wildcard version and product string, so the vendor advisory CV_2026_10_8 should be consulted to determine whether Commvault Cloud, on-premises HyperScale MediaAgents, or both are in scope and which maintenance releases are affected.
Know when Commvault gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable path traversal needing a low-privileged account (PR:L), low complexity, yielding high confidentiality disclosure only, with no integrity or availability impact.
Primary rating from Vendor (Commvault).
CVSS VectorVendor: Commvault
DescriptionCVE.org
HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.
Executive ViewAI
Commvault HyperScale MediaAgents are affected by a path traversal flaw (CVE-2026-18228) that allows a low-privileged authenticated user to read files outside the intended directory over the network. Because MediaAgents sit at the center of the backup and recovery fabric, exposed files could include configuration data, credentials, or backup content that underpins the organization's ability to recover from disruptive events. Leadership should note that the realistic threat is insider or stolen-credential abuse rather than anonymous internet attack, and that no vendor-released patch had been identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to MediaAgent services to trusted management hosts via firewall/ACL rules, reviewing and rotating MediaAgent credentials with least privilege and removal of shared or stale accounts, enhanced logging and monitoring of file-access and authentication activity, and applying the resolved maintenance release per vendor advisory CV_2026_10_8 once version details are confirmed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Commvault Command Center Innovation Release allows unauthenticated remote code execution through path traversal in ZIP f
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access thr
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack
Commvault Web Server allows authenticated remote attackers to create and execute webshells, exploited in the wild alongs
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments
In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, D
During the brief window between installation and the first administrator login, remote attackers may exploit the default
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted seri
Unauthenticated remote command execution in Commvault CVFS, the file system component shipped with Commvault Grid (Hyper
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privileg
Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operati
Exploit-DB