EUVD-2026-98762
GHSA-83mj-r2gx-wf57
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach MediaAgent service over network
-
DeliverySend crafted malformed input
-
ExploitTrigger heap buffer overflow
-
ExecutionCorrupt heap memory
-
ImpactCrash backup service (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated, low-complexity exploitation with no user interaction against a Commvault MediaAgent service. The practical limiting factor is exposure: the MediaAgent/HyperScale service port must be reachable by the attacker, so environments that segment or firewall backup infrastructure from untrusted networks sharply reduce real-world risk. Impact is limited to availability (service crash/DoS); there is no path to data disclosure or code execution per the provided vector, and remediation requires upgrading MediaAgents and HyperScale to the resolved maintenance release. |
| Impact | The input assigns CVSS 4.0 base score 8.7 (HIGH) with vector AV:N/AC:L/PR:N/UI:N and impact confined to availability (VA:H; VC:N/VI:N, no confidentiality or integrity effect), which is consistent with the description of a heap-based buffer overflow 'affecting service availability' - i.e. a remote, unauthenticated denial-of-service rather than a code-execution or data-disclosure flaw. No EPSS score, CISA KEV entry, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. The score is driven almost entirely by the network-reachable, no-auth, low-complexity access path rather than by impact breadth, so this is a genuine but availability-scoped issue: the high rating reflects easy reachability, not system compromise. For a Commvault MediaAgent/HyperScale node - a backup/data-protection component - loss of availability can disrupt backup and recovery operations, which raises its practical importance above a generic DoS even though no data is exposed. Key missing signals (EPSS, KEV, POC, SSVC, exact affected/fixed versions) should be confirmed against the vendor advisory before final prioritization. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with network reachability to a Commvault MediaAgent sends crafted input that triggers a heap-based buffer overflow in the service, corrupting memory and crashing or hanging the process. This disrupts backup and recovery availability on the affected MediaAgent/HyperScale node. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
A heap-based buffer overflow in Commvault MediaAgent (and the associated HyperScale deployment) can be triggered over the network by an unauthenticated attacker, causing the service to crash and denying backup/data-protection availability. The affected component is the MediaAgent service within Commvault Cloud; per the provided CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required, though exploitation depends on the attacker being able to reach the MediaAgent/HyperScale service port, so firewall-segmented backup networks are materially less exposed. Impact is confined to availability (VA:H, with VC:N/VI:N), and there is no public exploit identified at time of analysis; CISA KEV does not list this issue. The input assigns CVSS 4.0 base 8.7 (HIGH); the independent assessment scores it 7.5 (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and both agree the effect is denial of service only.
RemediationAI
Apply the vendor's resolved maintenance release and update every Commvault MediaAgent and HyperScale instance to that build, following the advisory at https://documentation.commvault.com/securityadvisories/CV_2026_10_6.html - patch status is 'Patch available per vendor advisory' (the input names a resolved maintenance release but does not provide an exact version number, so confirm the specific build on the advisory page rather than assuming one). Until upgrading is complete, the most effective compensating control is network exposure reduction, because the assessed vector requires the attacker to reach the MediaAgent/HyperScale service port: place MediaAgents on a management VLAN, block their service ports at the perimeter and between security zones with host or network firewalls, and allow inbound connections only from known backup servers, proxies, and administrative jump hosts. The trade-off is that tightening these rules can break cross-site or cloud-to-on-premises backup and replication jobs, so validate connectivity with a test job before enforcing broadly. If a MediaAgent service must be internet-adjacent, front it with a VPN or an authenticated reverse proxy, but note this reduces rather than eliminates risk and does not replace the vendor patch; monitoring the MediaAgent process for repeated crashes can also provide an early indicator of attempted exploitation, though it is a detection measure, not a mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MediaAgent is the data-mover component of Commvault's backup and recovery platform, responsible for reading, writing, and deduplicating backup data across media and storage targets; HyperScale is the hyperconverged appliance-style deployment that embeds MediaAgent services. The flaw is a heap-based buffer overflow - the memory-corruption class (CWE-122 family) in which a length or index derived from network-supplied input is not adequately validated before a heap buffer write, resulting in memory corruption that typically manifests as an abnormal process termination. Because Commvault did not supply a CWE identifier and the advisory is referenced only via the vendor security-advisory page, the precise parsing or protocol path is not publicly detailed; the CPE record identifies the affected product line as cpe:2.3:a:commvault:commvault_cloud with a wildcard version, meaning the advisory covers Commvault Cloud releases prior to the resolved maintenance release rather than a single pinned build. The assessed CVSS 3.1 vector (S:U, C:N/I:N/A:H) and the vendor's CVSS 4.0 vector (VC:N/VI:N/VA:H) both confirm that no confidentiality or integrity loss path is established by the available data - the primitive is a crash/denial-of-service, not remote code execution. As with most backup-infrastructure overflow bugs, the practical attack surface is the management/data service listener on the MediaAgent host, which is normally deployed on internal networks.
Know when Commvault gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable, unauthenticated, low-complexity DoS with no user interaction (AV:N/AC:L/PR:N/UI:N); heap overflow yields availability loss only (A:H), no confidentiality or integrity impact.
Primary rating from Vendor (Commvault).
CVSS VectorVendor: Commvault
DescriptionCVE.org
MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.
Executive ViewAI
Commvault MediaAgent and HyperScale deployments are affected by a high-severity heap-based buffer overflow that can be triggered over the network by an unauthenticated attacker, leading to service crashes and disruption of backup and data-protection operations. While no public exploit has been identified, the lack of a vendor patch and the potential for unauthenticated denial of service mean that organizations relying on Commvault for backup availability should prioritize exposure reduction. Leadership should care because prolonged backup outages can impair recovery capabilities and affect business continuity, especially if the backup infrastructure is reachable from untrusted networks.
No vendor-released patch identified at time of analysis; interim mitigations include network segmentation and firewall rules to restrict access to the MediaAgent/HyperScale service port to trusted backup networks, monitoring for service crashes, and ensuring alternative recovery paths are available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Commvault Command Center Innovation Release allows unauthenticated remote code execution through path traversal in ZIP f
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access thr
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack
Commvault Web Server allows authenticated remote attackers to create and execute webshells, exploited in the wild alongs
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments
In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, D
During the brief window between installation and the first administrator login, remote attackers may exploit the default
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted seri
Unauthenticated remote command execution in Commvault CVFS, the file system component shipped with Commvault Grid (Hyper
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privileg
Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operati
Exploit-DB