EUVD-2026-98764
GHSA-6f78-rvx4-53fm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Commvault network messaging layer
-
DeliverySend highly compressed crafted payload
-
ExploitTrigger excessive decompression
-
ExecutionExhaust service resources
-
ImpactBackup service unavailable (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Compression ratio limits
|
| Exploitation Conditions | No special conditions beyond network reachability to a Commvault component exposing the vulnerable network messaging layer (CommServe server, Web Server, Command Center, MediaAgents, clients, or HyperScale) - exploitation is remote and unauthenticated (PR:N, UI:N) against default configurations. Limiting factors: impact is confined to availability (service disruption/DoS) with no data read or modification, and an attacker must be able to deliver a highly compressed message to the messaging service, so network segmentation or restricting exposure of these management/backup ports materially reduces real-world exposure. |
| Impact | This is an availability-only denial-of-service flaw in Commvault's network messaging layer, caused by improper handling of highly compressed data (a classic decompression/'zip bomb' resource-exhaustion pattern). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) is internally consistent: network-reachable, low complexity, no authentication, no user interaction, and impact confined entirely to availability (VC:N/VI:N, VA:H) with no confidentiality or integrity loss and no scope change. The 8.7 base score is driven almost wholly by the ease of reaching the flaw rather than by impact breadth - it crashes/degrades a service but does not expose or alter data. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so exploitation likelihood cannot be quantified from the input; per rules this is treated as 'no public exploit identified at time of analysis.' CONFLICT TO NOTE: the input Tag 'Information Disclosure' contradicts the CVSS impact metrics and the description, which describe a service-availability (DoS) issue with VC:N/VI:N - the tag appears mislabeled and should not drive prioritization. Net: a genuinely easy-to-reach unauthenticated DoS against a core enterprise backup platform warrants prompt patching, but because impact is availability-only (no data compromise) it is a lower-urgency priority than the raw 8.7 might suggest, absent any evidence of active exploitation. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with network reachability to a Commvault component's messaging layer (e.g., CommServe, Web Server, or MediaAgent) sends a specially crafted, highly compressed message. When the service decompresses it, resource consumption spikes and the backup/recovery service becomes unavailable. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Unauthenticated remote attackers can exhaust resources and disrupt availability across Commvault Cloud deployments by sending specially crafted, highly compressed messages to the platform's network messaging layer. Affected components include the CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale nodes, meaning any deployment exposing the messaging service on the network is reachable under default configurations (PR:N, UI:N). Impact is confined to availability (service disruption/denial of service) with no confidentiality or integrity loss, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS data was not provided. Commvault has resolved the issue in a maintenance release and directs all customers to upgrade.
RemediationAI
Apply the vendor's resolved maintenance release as documented in the Commvault security advisory https://documentation.commvault.com/securityadvisories/CV_2026_10_3.html, upgrading every installation in the environment - CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale - since a partially patched deployment leaves unpatched components able to propagate or accept the malformed compressed messages. No exact fix version string is present in the supplied data, so confirm the target build against the advisory before upgrading rather than assuming a version number. Until upgrading is possible, reduce exposure by segmenting and firewalling the Commvault management and messaging ports so only trusted backup/administration subnets can reach them (trade-off: Commserve-to-MediaAgent and client traffic over untrusted links must be re-routed or tunneled, and remote/off-site agents may lose connectivity); where the messaging service supports it, front-end with a proxy or load balancer that enforces maximum request/message size and decompression-ratio limits (trade-off: legitimate large catalog or index payloads may be rejected and need tuning or exclusion). Additionally, monitor Commvault service processes for abnormal memory/CPU spikes or simultaneous restarts that would indicate an in-progress compression-based resource exhaustion attempt, and ensure the service runs with resource-cgroup limits so a single abused endpoint cannot exhaust host memory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in Commvault's network messaging layer, the inter-component transport used for coordination and data movement between CommServe, Web Server, Command Center, MediaAgents, clients, and HyperScale nodes. The root cause is improper handling of highly compressed data - the classic decompression-bomb or archive-expansion resource-exhaustion pattern, which corresponds to CWE-409 (Improper Handling of Highly Compressed Data) and, in effect, CWE-400 (Uncontrolled Resource Consumption); no CWE was formally assigned in the supplied metadata. Because the messaging service parses attacker-supplied payloads before authenticating the sender and without bounding the expansion ratio or resulting allocation, a small compressed input can be inflated into a disproportionately large in-memory or on-disk working set, starving the process or host of memory and CPU and taking the service down. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms this is a network-reachable, unauthenticated, no-interaction availability-only issue (CVSS 4.0 base 8.7 per the vendor, with VC:N/VI:N/VA:H). CPE data maps the affected product to cpe:2.3:a:commvault:commvault_cloud with an unconstrained version wildcard, indicating the vendor advisory covers the product line rather than a single pinned build.
Know when Commvault gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated decompression-bomb DoS reachable over the network with low complexity (AV:N/AC:L/PR:N/UI:N); impact is availability-only, so C:N/I:N/A:H and no scope change.
Primary rating from Vendor (Commvault).
CVSS VectorVendor: Commvault
DescriptionCVE.org
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.
Executive ViewAI
Commvault Cloud - the platform underpinning enterprise backup, recovery, and cyber-resilience operations - is exposed to an unauthenticated remote denial-of-service condition rated CVSS 8.7 that can degrade or take down the CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale nodes. Because no credentials are required and default deployments expose the messaging service, any internet- or network-reachable Commvault environment is a candidate for disruption, which directly threatens the organization's ability to restore data during an incident. Leadership should care because the exposure is availability-focused: the worst case is an outage of critical data-protection infrastructure at the moment it is needed, not a data breach.
No vendor-released patch version was identified at time of analysis, although Commvault states the issue is resolved in a maintenance release and directs customers to upgrade - obtain the exact version from the vendor advisory. Until the upgrade is applied: restrict network access to the Commvault messaging service to trusted management subnets via firewall and segmentation rules, apply rate limiting or connection throttling and message-size limits where configurable, disable or block unnecessary external exposure of CommServe, Command Center, and Web Server interfaces, deploy DoS/anomaly detection or IPS signatures for highly compressed message floods against Commvault endpoints, and prepare tested backup and failover procedures for the Commvault management tier in case of disruption.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Commvault Command Center Innovation Release allows unauthenticated remote code execution through path traversal in ZIP f
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access thr
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack
Commvault Web Server allows authenticated remote attackers to create and execute webshells, exploited in the wild alongs
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments
In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, D
During the brief window between installation and the first administrator login, remote attackers may exploit the default
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted seri
Unauthenticated remote command execution in Commvault CVFS, the file system component shipped with Commvault Grid (Hyper
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privileg
Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operati
Exploit-DB