EUVD-2026-98757
GHSA-fr5f-qvc7-98xj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege Commvault access
-
DeliveryReach network-exposed CvFWD service
-
ExploitSend crafted input triggering integer overflow
-
ExecutionCrash or hang the service
-
ImpactDenial of service to backup operations
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the CvFWD service (the Commvault network-forwarding/routing daemon) and low-privilege authenticated access to a Commvault installation (CVSS PR:L), with no user interaction needed. The attacker triggers an integer overflow in CvFWD that degrades service availability (DoS); there is no confidentiality or integrity impact. Limiting factors: the authentication requirement excludes fully unauthenticated attackers, and impact is confined to availability - the flaw cannot be leveraged for code execution or data access. Affected scope spans Commvault components (CommServe, Web Server, Command Center, MediaAgents, Clients, and HyperScale); risk is highest where these management/network services are exposed. Remediation is to upgrade to the resolved maintenance release across all installations. |
| Impact | This is a moderate-severity, availability-only vulnerability. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) indicates a network-reachable, low-complexity flaw requiring low-level authentication and no user interaction, with impact confined entirely to availability (VA:H; confidentiality and integrity both N). This is consistent with an integer overflow that crashes the CvFWD service rather than enabling code execution or data theft. On real-world risk signals: there is no CISA KEV listing, no public exploit code, and no EPSS score provided in the input, so exploitation probability cannot be quantified from the data given. The PR:L requirement meaningfully limits the attacker population to those who already hold valid (even low-privilege) credentials or access to a Commvault environment, which argues against opportunistic internet-wide mass exploitation. Net assessment: a legitimate patch-worthy issue - particularly for internet-exposed Commvault management components - but not an emergency given the availability-only impact and the authentication prerequisite. Treat as a standard prioritized patch rather than a drop-everything event unless the affected service is externally exposed. |
| Exploit ScenarioDerived | An attacker with low-privilege authenticated access to a Commvault environment sends specially crafted input to the network-facing CvFWD service, triggering an integer overflow that crashes or hangs the service and disrupts backup/data-protection operations. No public exploit code has been identified at time of analysis. Because impact is limited to availability, the result is a denial of service rather than code execution or data compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An integer overflow in CvFWD, the Commvault network-forwarding daemon used across Commvault Cloud deployments, lets a low-privilege authenticated attacker on the network crash or degrade the forwarding service, producing an availability-only denial of service with no confidentiality or integrity impact. All Commvault components that ship or communicate with CvFWD are in scope - CommServe, Web Server, Command Center, MediaAgents, Clients and HyperScale - so risk is highest in environments where these services are reachable from broad or untrusted network segments rather than restricted management networks. The vendor classifies this as a 7.1 (CVSS 4.0) issue requiring PR:L; there is no public exploit identified at time of analysis and no CISA KEV listing, and EPSS data was not provided, so the practical near-term driver is patch hygiene rather than active exploitation.
RemediationAI
Apply the vendor's resolved maintenance release across every Commvault installation - CommServe, Web Server, Command Center, MediaAgents, Clients and HyperScale - since Commvault explicitly requires updating all tiers rather than only the CommServe host; the exact build numbers are published in the advisory at https://documentation.commvault.com/securityadvisories/CV_2026_10_2.html and should be matched per component. Patch status is best described as patch available per vendor advisory, with no specific fix version captured in the intelligence feed. Because exploitation requires network reachability to CvFWD plus a valid authenticated account, the highest-value compensating control is to firewall/segment the CvFWD ports so that only trusted management subnets and known CommCell peers can reach them - the trade-off is that over-restrictive rules break forwarding and replication between CommServe, MediaAgents, clients and HyperScale nodes, so map the required port matrix before tightening. Second, reduce the authenticated attack surface by ensuring low-privilege or service accounts are not usable from untrusted segments and are rotated/audited, accepting that this only raises the bar rather than eliminating the flaw. Third, add monitoring and alerting for CvFWD process crashes, restarts or forwarding stalls as a detection compensating control; this adds no protection but shortens time-to-detection. No confidentiality or integrity exposure is associated with this issue, so incident response can focus on service recovery and availability of the forwarding stack rather than data-breach triage.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CvFWD is Commvault's network-forwarding/routing daemon, the component that brokers traffic between CommCell roles such as CommServe, MediaAgents, Web Server, Command Center, clients and HyperScale nodes. The reported defect is an integer overflow in that daemon: a size, length or counter calculation derived from attacker-influenced input wraps or exceeds its type bounds, corrupting the daemon's internal state and taking the forwarding service down. Commvault did not assign a CWE in the data available here, but the flaw class maps to CWE-190 (Integer Overflow or Wraparound) and is tagged in intelligence feeds as a buffer-overflow-family issue, which is typical for unchecked arithmetic on length fields. Importantly, the supplied CPE identifies the affected product as Commvault Cloud (cpe:2.3:a:commvault:commvault_cloud), and both the CVSS 4.0 vector (VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) and our independent CVSS 3.1 assessment (C:N/I:N/A:H) converge on impact confined to availability - no code execution, credential disclosure or data modification is implied, even though the underlying arithmetic error is memory-safety adjacent. The CVSS 4.0 vector's PR:L and AT:N show that reachability to the CvFWD service plus any authenticated account is sufficient, with no user interaction and no race or timing precondition.
Know when Commvault gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable CvFWD service with low complexity and low-privilege authentication (PR:L); integer overflow yields availability-only DoS, so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (Commvault).
CVSS VectorVendor: Commvault
DescriptionCVE.org
CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale
Executive ViewAI
A high-severity flaw in Commvault's CvFWD network-forwarding daemon, which is embedded across CommServe, Web Server, Command Center, MediaAgents, Clients and HyperScale, allows an authenticated low-privilege user with network reachability to crash or degrade the forwarding service and disrupt backup and data-protection operations. There is no confidentiality or integrity exposure and no vendor patch is currently available, so the risk is primarily operational resilience for environments where Commvault components are reachable from broad or untrusted network segments. Leadership should care because unplanned outages of the backup forwarding path can halt scheduled protection jobs, delay recovery readiness, and require costly manual intervention, particularly in regulated or high-availability environments.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict CvFWD network reachability to trusted management subnets via firewall rules and network segmentation; enforce least privilege on Commvault accounts to limit authenticated low-privilege access; monitor and alert on daemon crashes, restarts, and service degradation; ensure tested failover/restart automation and redundancy for CommServe and MediaAgents; log and review access to Commvault management interfaces.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Commvault Command Center Innovation Release allows unauthenticated remote code execution through path traversal in ZIP f
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access thr
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack
Commvault Web Server allows authenticated remote attackers to create and execute webshells, exploited in the wild alongs
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments
In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, D
During the brief window between installation and the first administrator login, remote attackers may exploit the default
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted seri
Unauthenticated remote command execution in Commvault CVFS, the file system component shipped with Commvault Grid (Hyper
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privileg
Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operati
Exploit-DB