Commvault CVFS CVE-2026-77090

Exploitation requires reaching a CVFS interface that parses attacker-supplied XML with external-entity resolution enabled; the flaw lies in Commvault's CVFS XML external entity reference handling. Per the vendor CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N), no authentication, no user interaction, and no special attack requirements are needed, so a network-reachable vulnerable CVFS/Commvault Cloud or Grid HSX instance running an unpatched maintenance release can be attacked directly. The primary limiting factors are network exposure of the XML-accepting endpoint (storage/backup management planes are frequently internal-only) and whether the deployment is still on a pre-fix maintenance release; impact is confined to information disclosure (VC:H, VI:N/VA:N), with no integrity or availability effect.

This is a CVSS 4.0 8.7 (HIGH) XXE information-disclosure flaw in Commvault's CVFS component. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) describes a remotely reachable, low-complexity, unauthenticated vulnerability with high confidentiality impact and no integrity or availability impact - consistent with a classic XXE that forces the parser to disclose file contents or perform SSRF-style reads. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no evidence of active exploitation or weaponized exploit code at this time. The practical signals therefore conflict with the raw score: the CVSS metrics suggest an easy, high-impact remote bug, but the absence of any exploitation indicator (KEV/EPSS/POC) means this is currently a patch-promptly item rather than a confirmed emergency. XXE in a backup/storage platform is notable because such systems often hold sensitive data and run with broad filesystem access, so the confidentiality impact is credible. The single vendor reference (Commvault security advisory CV_2026_07_4) is the only corroborating source; NVD-level enrichment and CWE classification are absent (CWE listed as N/A), which limits independent cross-verification.

A remote, unauthenticated attacker submits a crafted XML document (e.g., to a CVFS API or import/parsing endpoint) containing an external entity reference. The vulnerable parser resolves the entity and returns the contents of local files or internal resources to the attacker, disclosing sensitive data such as configuration, credentials, or backed-up content. No public exploit was identified at time of analysis, and the CVSS vector indicates no authentication or user interaction is required.