Which versions of Commvault CommServe are affected by EUVD-2026-56002?

An authorization bypass vulnerability (CVE-2026-13738) in Commvault CommServe enables remote attackers to execute commands without proper authorization checks across cloud and on-premises…

How to fix or mitigate EUVD-2026-56002?

Within 24 hours: inventory all Commvault deployments, search access logs for unauthorized remote command execution attempts, and subscribe to Commvault security advisory CV_2026_07_9 for patch notification. Within 7 days: implement network segmentation restricting direct access to CommServe infrastructure, enforce role-based access controls limiting administrative privileges, and disable unnecessary remote administration interfaces. Within 30 days: deploy the vendor-released patch immediately upon availability and conduct a security assessment of all Commvault-managed backup systems and data.

Commvault CommServe EUVD-2026-56002

Q: What is the CVSS score of EUVD-2026-56002?

EUVD-2026-56002 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-13738 CRITICAL

Incorrect Authorization (CWE-863)

2026-08-11 Commvault

GHSA-98g5-m37p-p3v2

Authentication Bypass Commvault Commvault Cloud

9.2

CVSS 4.0 · Vendor: Commvault

Severity by source

Vendor (Commvault) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated (AV:N/PR:N) per vendor, but a non-trivial precondition on a limited operation set warrants AC:H; full C/I/A impact on the backup controller, scope unchanged.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Commvault).

CVSS VectorVendor: Commvault

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:01 vuln.today

CVE Published

Aug 11, 2026 - 11:01 cve.org

CRITICAL 9.2

DescriptionCVE.org

CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

AnalysisAI

Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operations without passing the intended authorization checks, per Commvault security advisory CV_2026_07_9. The flaw carries a CVSS 4.0 base score of 9.2 with high impact to confidentiality, integrity, and availability, and affects Commvault Cloud deployments across the CommServe, Web Server, Command Center, MediaAgents, Clients, and HyperScale X components. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

CommServe is the central control and orchestration server of the Commvault data-protection platform, coordinating backup, recovery, and administrative operations across MediaAgents, clients, the Web Server, and Command Center. The issue is an authorization/authentication bypass (vendor tag: 'Authentication Bypass') in the code path that gates specific command-execution operations, allowing those operations to be reached without the proper authorization state - conceptually a broken/missing access-control (CWE-285/CWE-862 class) weakness, though the input lists CWE as N/A so the exact weakness class is not vendor-assigned. The affected CPE is cpe:2.3:a:commvault:commvault_cloud, indicating the Commvault Cloud product line; because CommServe brokers privileged operations across the entire backup fabric, an authorization gap there has outsized blast radius.

RemediationAI

Patch available per vendor advisory: upgrade to the resolved Commvault maintenance release referenced in CV_2026_07_9 (https://documentation.commvault.com/securityadvisories/CV_2026_07_9.html); no exact fixed version number is provided in the input, so confirm the target build directly with Commvault. Apply the update across every Commvault component - CommServe, Web Server, Command Center, MediaAgents, Clients, and HyperScale X - since the advisory explicitly calls for updating all installations rather than CommServe alone. Until patching completes, restrict network reachability of the CommServe and Command Center management interfaces to trusted administrative networks/VPN only and place them behind segmentation so the vulnerable command-execution endpoints are not exposed to broad or internet-facing access; the trade-off is that overly aggressive network restrictions can disrupt distributed MediaAgent/client communications, so scope firewall rules to management planes rather than data paths.