EUVD-2026-98761
GHSA-96p4-48xx-h4f4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed CVFS network interface
-
DeliverySubmit crafted unvalidated input
-
ExploitBypass input validation
-
ExecutionTrigger command execution
-
ImpactFull compromise of backup node
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) this is remote, pre-authentication exploitation requiring no user interaction against a reachable Commvault CVFS (Grid HSX) / Commvault Cloud instance. However, the advisory description does not name the specific feature, protocol endpoint, or configuration required, so the exact triggering surface is undisclosed - exposure of the CVFS management/data interface to the attacker is the practical prerequisite. The primary limiting factor is network reachability of the CVFS component while running an unpatched maintenance release; installing the resolved maintenance release removes the condition. No authentication or special non-default configuration is indicated as required. |
| Impact | Signals point to a genuine high priority, but on sparse data. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, score 9.3) describes a remotely reachable, low-complexity, pre-authentication flaw yielding full confidentiality, integrity and availability impact - consistent with the description of an input-validation flaw 'affecting command execution' (i.e. likely command injection/remote code execution). No EPSS score, CISA KEV listing, or POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The CVSS severity is therefore not corroborated by any exploitation-probability signal, meaning this is a high-severity issue whose real-world exploitation likelihood is currently unquantified rather than a confirmed in-the-wild threat. Two data conflicts should be flagged: the 'Information Disclosure' tag contradicts the description of command execution and the full VC/VI/VA:H impact (which indicates code execution, not mere disclosure) - verify the vulnerability class with Commvault; and the description is extremely terse with CWE marked N/A, so the specific weakness is unconfirmed. |
| Exploit ScenarioDerived | A remote attacker sends crafted input to an exposed Commvault CVFS (Grid HSX) interface that is not properly validated, allowing injection that reaches a command-execution path. Per the CVSS vector this requires no authentication, no user interaction, and low attack complexity, giving the attacker control over the backup storage node. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated remote command execution in Commvault CVFS, the file system component shipped with Commvault Grid (HyperScale X) deployments and exposed through Commvault Cloud, allows a network-reachable attacker to execute commands on the underlying system with high impact to confidentiality, integrity, and availability - Commvault scores it 9.3 under CVSS 4.0. Per the vendor CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) the issue is remotely triggerable without credentials or user interaction, which makes any internet- or broadly reachable CVFS endpoint a priority exposure; the advisory does not name the specific feature, protocol endpoint, or configuration path that must be reached. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and a fixed maintenance release is available from Commvault.
RemediationAI
Apply the resolved maintenance release from Commvault (security advisory CV_2026_10_9 at https://documentation.commvault.com/securityadvisories/CV_2026_10_9.html), which is the vendor's stated remedy - software customers must upgrade to the resolved maintenance release and update CVFS; note that the exact fixed build number is not published in the data provided here and must be taken from that advisory, while vendor advisories for this product line have reserved a patch identity (CV_2026_10_9), so the safe classification is 'patch available per vendor advisory' rather than 'no patch.' Because CVFS is a storage/file-system layer on Grid (HSX) and Commvault Cloud, treat the update as two-stage: patch the CVFS/Grid HSX nodes first, then confirm any Commvault Cloud components that consume them are on a resolved maintenance release, since a mixed-version fleet may leave an unpatched CVFS peer reachable. Until the upgrade is complete, the most effective compensating control is to remove network reachability to the CVFS management and data interfaces: restrict them to trusted management subnets, media-agent/client address ranges, and administrative jump hosts via host and network firewall rules, and do not expose CVFS ports to the internet or to general user VLANs. The trade-off is real - aggressive segmentation blocks legitimate backup, restore, and replication traffic between media agents and clients, so validate the allow-list in a staging window and keep management access open only from known operations hosts. Additional containment: require administrative access to the CVFS/Commvault management plane to traverse a VPN or bastion with MFA, and alert on unexpected outbound connections or shell-like child processes spawned by CVFS services, since those are the observable indicators of command execution on an already-compromised node. There is no vendor-published workaround beyond patching; disabling CVFS is not viable in production because it is the data path, so network restriction plus monitoring is the practical interim posture. Note that no public exploit code and no confirmed active exploitation were identified at time of analysis, so these controls are prioritized on the 9.3 severity and pre-auth remote reachability rather than on observed attacks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-77099 is an input validation failure in CVFS, the Commvault file system layer that underpins Grid/HSX storage and is reachable from Commvault Cloud deployments, where untrusted input is passed into a command execution path. Commvault's description is deliberately terse ('input validation issue affecting command execution') and no CWE identifier is assigned in the supplied data, but the reported behavior is consistent with the OS command injection / improper input validation class (CWE-78 / CWE-20) rather than a memory-safety defect - the distinguishing factor being that attacker-supplied input influences an executed command rather than a buffer. The CPE entries cpe:2.3:a:commvault:commvault_cloud and cpe:2.3:a:commvault:grid(hsx)_cvfs both use wildcard version ranges, so the advisory has not been scoped to discrete builds in the data provided and every unpatched maintenance release of those components must be assumed affected. Note an internal inconsistency worth flagging during triage: the supplied tags label this 'Information Disclosure,' yet the CVSS 4.0 vector records VC:H/VI:H/VA:H (subsequent system impact SC:N/SI:N/SA:N), which describes full compromise of the vulnerable component, not mere disclosure - the command-execution description and the high integrity/availability impact are the more credible signals, and the 'Information Disclosure' tag should not be used to downgrade response. The practical prerequisite is network reachability of the CVFS management or data interface while running an unpatched release; no authentication, no user interaction, and no non-default configuration are indicated as required.
Know when Commvault gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description implies remote unauthenticated command execution with no user interaction (AV:N/AC:L/PR:N/UI:N) yielding full triad impact; scope unchanged as impact stays within the host.
Primary rating from Vendor (Commvault).
CVSS VectorVendor: Commvault
DescriptionCVE.org
CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
Executive ViewAI
Commvault Grid (HyperScale X) deployments and Commvault Cloud environments exposing the CVFS file-system component are affected by a critical flaw that allows an unauthenticated, network-reachable attacker to execute commands on the underlying host. Because backup infrastructure holds an organization's most sensitive data and the means to restore or destroy it, a successful compromise could result in data theft, tampering, or loss of recovery capability - a direct business-continuity and ransomware exposure. No public exploit code has been identified at time of analysis, giving a limited window to reduce exposure before attack tooling appears.
No vendor-released patch identified at time of analysis per patch tracking, though the advisory references a fixed maintenance release without naming the version - confirm availability and exact version with Commvault. Interim mitigations: eliminate internet exposure of CVFS endpoints, restrict access to trusted management subnets via firewall rules and network segmentation, require VPN/zero-trust access for management interfaces, enforce MFA and least privilege on Commvault administration, enable and monitor CVFS/Grid host logging for anomalous command execution, and maintain isolated, immutable backups.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Commvault Command Center Innovation Release allows unauthenticated remote code execution through path traversal in ZIP f
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access thr
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack
Commvault Web Server allows authenticated remote attackers to create and execute webshells, exploited in the wild alongs
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments
In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, D
During the brief window between installation and the first administrator login, remote attackers may exploit the default
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted seri
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privileg
Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operati
Authorization bypass in Commvault CommServe permits attackers to circumvent the command-execution allowlist, gaining uns
Exploit-DB