EUVD-2026-98758
GHSA-37r8-2wf6-93jv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low privileges
-
ExploitReach network-facing CvFWD service
-
ExecutionSend crafted packet triggering out-of-bounds write
-
ImpactCrash daemon, deny backup availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the CvFWD component (Commvault's firewall/network communication daemon) and requires network reachability to that service plus low-privilege authenticated access to the Commvault environment (CVSS PR:L) - it is NOT unauthenticated. No user interaction is required (UI:N) and attack complexity is low (AC:L). The impact is strictly denial of service against the affected service (VA:H); there is no path to data disclosure or code execution from this vector. Limiting factors: the attacker must already hold valid low-level credentials and be able to reach the CvFWD service, and the flaw affects Commvault components (CommServe, Webserver, Command Center, MediaAgents, Clients, HyperScale) only until the resolved maintenance release is applied. |
| Impact | This is an availability-only flaw (CVSS 4.0 VA:H with VC:N/VI:N) - an out-of-bounds write in the CvFWD component (Commvault's firewall/network tunnel daemon) that can crash the service, not a code-execution or data-exposure bug. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network reachability, low attack complexity, and a low-privilege authenticated attacker, yielding a vendor score of 7.1 (High). No EPSS probability, CISA KEV listing, or public POC is present in the input, so this is 'no public exploit identified at time of analysis' and there is no evidence of active exploitation. Net assessment: a credible but second-tier priority - it is network-reachable and easy to trigger, but requires at least low-level authentication (PR:L) and yields only denial of service against a backup platform, not compromise. The CWE is listed as N/A despite the description and tags clearly indicating an out-of-bounds write/buffer overflow - this gap should be noted but does not change the availability-only impact. Treat as an important patch for backup-infrastructure resilience rather than an emergency. |
| Exploit ScenarioDerived | An authenticated attacker with low-privilege access to a Commvault environment sends crafted traffic to the network-facing CvFWD service, triggering an out-of-bounds write that crashes the daemon and disrupts backup/restore communications. No public exploit code is identified at the time of analysis, and the impact is limited to loss of availability rather than data theft or code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An out-of-bounds write in Commvault's CvFWD network-communication daemon allows a low-privilege authenticated attacker who can reach the service over the network to crash it, producing a denial of service against the affected Commvault component. The flaw is availability-only (CVSS 4.0 7.1, VA:H with VC:N/VI:N) and offers no path to data disclosure or code execution; it affects Commvault Cloud deployments, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale, until the resolved maintenance release is applied. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Patch status: patch available per vendor advisory - Commvault directs software customers to upgrade to the resolved maintenance release described in advisory CV_2026_10_1 (https://documentation.commvault.com/securityadvisories/CV_2026_10_1.html); no exact build number is specified in the available data, so confirm the target version against that advisory before upgrading, and apply it across every component: CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale. If the upgrade cannot be staged immediately, compensating controls should target the two prerequisites for exploitation: network reachability and valid credentials. Restrict network access to the CvFWD service so that only trusted Commvault component subnets and administrative hosts can connect - the trade-off is that overly broad firewall rules will break inter-component communication, backup jobs, and replication, so rules must be scoped per deployment topology and tested. Audit and minimize the credentials available to non-administrative users in the Commvault environment, since the flaw requires only low-privilege authenticated access (PR:L), and monitor the CvFWD daemon for unexpected restarts or crash events as a detection signal. Neither workaround removes the underlying out-of-bounds write, so they should be treated as temporary measures until the maintenance release is installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CvFWD is Commvault's firewall/network tunnel daemon that brokers communication between Commvault components such as the CommServe, Web Server, Command Center, MediaAgents, Clients and HyperScale nodes. The defect is an out-of-bounds memory write (the buffer-overflow/memory-corruption class, corresponding to CWE-787 even though no CWE identifier is populated in the feed data), meaning input reaching the daemon is not adequately bounds-checked before being written to a fixed-size buffer. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires network reachability to the CvFWD service plus valid low-privilege credentials in the Commvault environment - it is not unauthenticated - and no user interaction is needed. Successful triggering terminates or destabilizes the daemon, and by extension the component it serves, with the impact scoped strictly to availability; the memory-corruption nature of the write is not assessed here as yielding control-flow hijack or information leakage.
Know when Commvault gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-facing CvFWD daemon with low-complexity trigger but requiring low-privilege authentication (PR:L); out-of-bounds write affects only availability, so C:N/I:N/A:H.
Primary rating from Vendor (Commvault).
CVSS VectorVendor: Commvault
DescriptionCVE.org
CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
Executive ViewAI
A denial-of-service vulnerability in Commvault's CvFWD network-communication daemon (CVE-2026-77094) allows an attacker holding a valid low-privilege account and network reach to the service to crash it, degrading the availability of the company's Commvault Cloud environment across CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale. There is no path to data disclosure or code execution, so the exposure is continuity of backup and recovery operations rather than data loss or breach. Leadership should care because sustained interruption of the backup platform erodes recovery readiness and can stall restoration precisely when it is needed most.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability to the CvFWD daemon through firewall rules and network segmentation; enforce least privilege and strong authentication on all Commvault accounts; monitor for daemon crashes, unexpected restarts and anomalous inbound connections; and validate backup failover and recovery procedures so operations can continue if a component is disrupted.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Commvault Command Center Innovation Release allows unauthenticated remote code execution through path traversal in ZIP f
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access thr
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack
Commvault Web Server allows authenticated remote attackers to create and execute webshells, exploited in the wild alongs
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments
In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, D
During the brief window between installation and the first administrator login, remote attackers may exploit the default
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted seri
Unauthenticated remote command execution in Commvault CVFS, the file system component shipped with Commvault Grid (Hyper
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privileg
Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operati
Exploit-DB