EUVD-2026-72722
GHSA-mrh8-32mp-g8jf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Command Center API over network
-
ExploitSend request bypassing auth check
-
ExecutionObtain elevated privileges
-
ImpactControl backups/exfiltrate or destroy data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Commvault Command Center API endpoint; per CVSS 4.0 AV:N/AC:L/PR:N/UI:N no authentication or user interaction is needed against a reachable instance. The primary limiting factor is exposure: instances kept behind a VPN or internal-only network are not directly reachable by external attackers. The description does not specify whether a non-default configuration is required, so treat any network-reachable Command Center as exploitable pending vendor clarification. |
| Impact | The vendor CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity, unauthenticated flaw with high impact across all three security properties - a genuine high-priority issue for exposed Command Center instances, especially given that a backup/data-protection console holds keys to an organization's entire recovery estate. However, no EPSS score, KEV listing, or POC was supplied, so exploitation is currently a modeled/theoretical risk rather than confirmed in-the-wild activity; the CVSS is impact-driven, not evidence-of-exploitation-driven. The description is terse ('affecting privilege management') and does not specify whether the bypass is full pre-auth or a privilege-escalation from a lower-privileged session - verify exact scope with Commvault advisory CV_2026_07_1. |
| Exploit ScenarioDerived | An attacker who can reach the Command Center API over the network sends crafted requests that bypass the authentication/authorization check, gaining privileged access to the console without valid credentials. From there they could manipulate backup policies, exfiltrate protected data, or disable/destroy recovery points. No POC has been published at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privilege management controls in Commvault Cloud deployments. Per the CVSS 4.0 vector (VC:H/VI:H/VA:H) an attacker can reach a fully-privileged state affecting confidentiality, integrity and availability without credentials or user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Apply the resolved maintenance release for Command Center as directed in Commvault security advisory CV_2026_07_1 (https://documentation.commvault.com/securityadvisories/CV_2026_07_1.html); the input indicates a patch is available per vendor advisory but does not name an exact fixed version, so confirm the target build against that advisory. Until patched, restrict network reachability of the Command Center API - place it behind a VPN or IP-allowlist and block direct Internet exposure of the management endpoint - and monitor Command Center audit logs for anomalous privilege changes or unexpected administrative actions. The main trade-off of network restriction is reduced convenience for remote/administrative access, which is acceptable for a backup-control plane that should not be Internet-facing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Commvault Command Center is the web/API management console for Commvault's enterprise data-protection and backup platform (CPE cpe:2.3:a:commvault:commvault_cloud). The flaw resides in the Command Center API's authorization/authentication layer governing privilege management, meaning an access-control check can be bypassed to obtain rights the caller should not hold. No CWE was assigned in the input, but the behavior maps to the improper-authentication / authentication-bypass class (CWE-287/CWE-863 family), consistent with the vendor's 'Authentication Bypass' tag.
Know when Commvault gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable API auth bypass with no privileges or interaction and full CIA impact on the console; scope unchanged as impact stays within the Command Center system.
Primary rating from Vendor (Commvault).
CVSS VectorVendor: Commvault
DescriptionCVE.org
Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.
Executive ViewAI
Commvault Command Center API (Commvault Cloud deployments) contains an unauthenticated authentication bypass enabling attackers to gain full administrative access without credentials, threatening the integrity and availability of enterprise backup infrastructure. Organizations using Commvault for data protection face immediate risk of unauthorized data access, modification, or destruction, directly impacting business continuity and compliance capabilities.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict API access via firewall rules and network segmentation; implement IP-based access controls limiting requests to known administrative ranges; deploy Web Application Firewall rules to monitor for authentication bypass patterns; increase logging and alerting on API authentication events; maintain air-gapped offline backups independent of the affected Command Center instance; consider temporary disable of remote API access if operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Commvault Command Center Innovation Release allows unauthenticated remote code execution through path traversal in ZIP f
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access thr
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack
Commvault Web Server allows authenticated remote attackers to create and execute webshells, exploited in the wild alongs
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments
In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, D
During the brief window between installation and the first administrator login, remote attackers may exploit the default
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted seri
Unauthenticated remote command execution in Commvault CVFS, the file system component shipped with Commvault Grid (Hyper
Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operati
Authorization bypass in Commvault CommServe permits attackers to circumvent the command-execution allowlist, gaining uns
Exploit-DB