EUVD-2026-98759
GHSA-7j9q-82hv-h7rr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege Commvault access
-
ExploitReach CvFWD network service
-
ExecutionSend malformed request triggering null deref
-
ImpactCrash process, deny backup/recovery availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the CvFWD (Commvault network/firewall routing) service and requires a low-privilege authenticated account (CVSS PR:L) with network reachability to that service - it is not pre-authentication. No user interaction and low attack complexity are needed once access is obtained. The impact is limited to availability (service crash/denial of service) of Commvault components (CommServe, Webserver, Command Center, MediaAgents, Clients, HyperScale); there is no confidentiality or integrity exposure. The limiting factors are the authentication requirement and the DoS-only outcome, meaning realistic risk is confined to attackers who already hold at least minimal Commvault credentials or an environment foothold. |
| Impact | This is a moderate-priority availability-only vulnerability, not a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scores 7.1 and is internally consistent with the description: a network-reachable, low-complexity null pointer dereference in the CvFWD component that impacts only availability (VA:H) with no confidentiality or integrity effect. The PR:L requirement means an attacker needs at least low-level authenticated access, which meaningfully constrains opportunistic internet-wide abuse and points toward an authenticated insider or a foothold-dependent attacker rather than a pre-auth mass-exploitation scenario. No EPSS score was provided in the input, the CVE is not present in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The signals are mutually consistent (high-CVSS driven entirely by the availability impact of a crashable backup-infrastructure service), with no contradiction between vector and description. The main residual uncertainty is that CWE is listed as N/A and no SSVC/EPSS data was supplied, so exploitation likelihood must be inferred from the DoS-only, authenticated nature of the flaw rather than measured. |
| Exploit ScenarioDerived | A low-privileged authenticated actor (or an attacker who has already obtained limited Commvault credentials) sends a crafted request over the network to the CvFWD service, triggering a null pointer dereference that crashes the process. Because low attack complexity and no user interaction are required, the resulting denial of service can be repeated to disrupt backup, recovery, and data-protection operations across CommServe, MediaAgents, and clients. No public exploit code is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
A null pointer dereference in Commvault's CvFWD network routing service crashes affected components, producing a denial-of-service condition limited to availability. The flaw is remotely reachable over the network but requires a low-privilege authenticated account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, assessed 7.1 severity), with no confidentiality or integrity exposure - no data is read, modified, or exfiltrated. Commvault has published a security advisory (CV_2026_10_5) directing customers to a resolved maintenance release covering CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the available intelligence. Because the impact is availability-only and gated behind authentication, the realistic risk is moderate rather than emergency-grade, though environments that expose CvFWD broadly or tolerate unplanned service restarts should prioritize patching.
RemediationAI
The primary fix is to upgrade to the resolved maintenance release identified in Commvault security advisory CV_2026_10_5 (https://documentation.commvault.com/securityadvisories/CV_2026_10_5.html); the exact build number was not included in the intelligence provided, so administrators must read the version table in that advisory before scheduling the upgrade. Commvault's guidance is explicit that the update must be applied to every installation component - CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale - not just the management server, since a partially patched topology can retain a reachable CvFWD instance. Until the maintenance release is deployed, the most effective compensating control is to restrict network access to the CvFWD service so that only trusted management subnets and known Commvault component hosts can reach it; this directly removes the AV:N exposure path, with the trade-off that legitimate cross-site, remote-office, or cloud-hosted components may lose connectivity unless their addresses are explicitly allowlisted. Secondary measures include auditing and minimizing the population of low-privilege Commvault accounts that satisfy the PR:L requirement (disabling stale or service accounts and enforcing least privilege for backup operators), and configuring monitoring and alerting on CvFWD service termination or unexpected component restarts so a crash attempt is detected quickly; these reduce and detect attacker footholds but do not eliminate the underlying defect, so patching remains the only complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CvFWD is a Commvault network/firewall routing service component that brokers traffic between Commvault Cloud components such as CommServe, the Webserver, Command Center, MediaAgents, Clients, and HyperScale nodes. The defect is a null pointer dereference - the CWE field was not populated in the source data, but the description maps directly to the CWE-476 class, in which the service dereferences a pointer that was never initialized or that returned null, typically triggering a hard fault that terminates the process. Because the failure mode is an unhandled fault rather than memory corruption, the consequence is service unavailability (VA:H) rather than code execution or data exposure; the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms network reachability, low attack complexity, no user interaction, and an availability-only outcome with unchanged scope. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) is consistent with this reading: PR:L indicates the attacker must already hold at least minimal Commvault credentials, so this is a post-authentication, environment-foothold-reliant denial of service rather than a pre-auth crash. CPE data identifies the affected product stream as cpe:2.3:a:commvault:commvault_cloud, with the version field left wildcarded, meaning the intelligence does not pin the exact affected build range and remediation should be driven by the vendor advisory. Commvault's guidance explicitly extends to every installation component - CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale - underscoring that CvFWD is deployed across multiple tiers of the backup and data-protection fabric, and that a crash can propagate disruption across the management plane rather than only the node that handled the offending request.
Know when Commvault gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable, low-complexity crash needing a low-privilege account (PR:L), no user interaction, availability-only impact so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (Commvault).
CVSS VectorVendor: Commvault
DescriptionCVE.org
CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
Executive ViewAI
A high-severity null pointer dereference in Commvault's CvFWD network routing service can crash core backup infrastructure components - CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale - causing unplanned outages in the systems the organization relies on for data protection and recovery. The flaw is remotely reachable but gated behind a low-privilege authenticated account, so the practical exposure is largely internal: a compromised credential, a careless insider, or a poorly segmented management network could be used to repeatedly disrupt backup and restore operations. No data can be read, altered, or exfiltrated through this defect, so leadership should treat it as an availability and operational-resilience risk rather than a breach or data-loss event, though recovery-window degradation during an outage is the real business concern.
No vendor-released patch version identified at time of analysis; interim mitigations include network-restricting the CvFWD listener to trusted management subnets, reducing and auditing low-privilege authenticated accounts that could reach CvFWD, monitoring for service crashes and unplanned restarts, ensuring backup job schedules and recovery objectives can absorb a component restart, and engaging Commvault support via advisory CV_2026_10_5 to obtain the resolved maintenance release covering CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Commvault Command Center Innovation Release allows unauthenticated remote code execution through path traversal in ZIP f
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access thr
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack
Commvault Web Server allows authenticated remote attackers to create and execute webshells, exploited in the wild alongs
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments
In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, D
During the brief window between installation and the first administrator login, remote attackers may exploit the default
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted seri
Unauthenticated remote command execution in Commvault CVFS, the file system component shipped with Commvault Grid (Hyper
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privileg
Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operati
Exploit-DB