Commvault CVFS CVE-2026-77096

Exploitation requires adjacent-network access (AV:A) to a Commvault CVFS / Grid HSX node - the attacker must be on the same logical/broadcast network segment, not merely anywhere on the internet. No credentials are required (PR:N) and no user interaction is needed (UI:N), because an authentication check is missing on a command-execution path. The AT:P metric signals an additional attack precondition beyond the attacker's direct control must hold for the exploit to succeed. The primary limiting factors defenders can rely on are network adjacency and that attack precondition; segmenting backup/storage networks and restricting management-plane reachability materially reduces exposure. Remediation is to upgrade to the resolved Commvault maintenance release.

This is a genuine high-priority issue for Commvault environments, though its reach is constrained by the attack vector rather than by privilege requirements. The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) describes a missing-authentication flaw that allows an unauthenticated actor (PR:N) to achieve full compromise of confidentiality, integrity and availability (VC:H/VI:H/VA:H) with low complexity - serious because CVFS is backup storage infrastructure. However, two signals temper raw urgency: AV:A limits the attacker to the adjacent/logical network (not internet-wide reachability), and AT:P indicates a specific attack requirement/precondition must be met, so exploitation is not purely trivial against any reachable instance. No EPSS score, CISA KEV listing, or public exploit was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this appears to be a vendor-disclosed issue (reported by Commvault) rather than an observed in-the-wild threat. Net: a real priority to patch given full CIA impact and no authentication, but the adjacency requirement and attack precondition make opportunistic internet-wide mass exploitation unlikely. No conflicting signals detected; the scope metric (SC/SI/SA:N) correctly indicates no cross-system scope change.

An attacker positioned on the same adjacent/logical network as a Commvault CVFS (Grid HSX) node reaches an interface that is missing an authentication check and issues commands directly to the backup storage system, achieving command execution without credentials. Because the affected component governs backup data, this can lead to full compromise or destruction of protected backups. No public exploit code is known at time of analysis, so exploitation would require the attacker to develop it and to satisfy the attack precondition indicated by AT:P.