Commvault
Monthly
Unauthenticated remote attackers can exhaust resources and disrupt availability across Commvault Cloud deployments by sending specially crafted, highly compressed messages to the platform's network messaging layer. Affected components include the CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale nodes, meaning any deployment exposing the messaging service on the network is reachable under default configurations (PR:N, UI:N). Impact is confined to availability (service disruption/denial of service) with no confidentiality or integrity loss, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS data was not provided. Commvault has resolved the issue in a maintenance release and directs all customers to upgrade.
Denial of service against the QAPI service in Commvault Cloud can be triggered by an authenticated low-privilege user who sends a crafted request that overflows a stack buffer on CommServe, Web Server, Command Center, or Index Server. Per the vendor's advisory, exploitation is limited to service availability - there is no data disclosure, data tampering, or code execution impact (CVSS:4.0 vector VC:N/VI:N/VA:H, score 7.1), and the independent CVSS:3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) agrees that only availability is affected. Valid credentials are mandatory and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority availability issue rather than an emergency, but Commvault has directed customers to a resolved maintenance release.
A heap-based buffer overflow in Commvault MediaAgent (and the associated HyperScale deployment) can be triggered over the network by an unauthenticated attacker, causing the service to crash and denying backup/data-protection availability. The affected component is the MediaAgent service within Commvault Cloud; per the provided CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required, though exploitation depends on the attacker being able to reach the MediaAgent/HyperScale service port, so firewall-segmented backup networks are materially less exposed. Impact is confined to availability (VA:H, with VC:N/VI:N), and there is no public exploit identified at time of analysis; CISA KEV does not list this issue. The input assigns CVSS 4.0 base 8.7 (HIGH); the independent assessment scores it 7.5 (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and both agree the effect is denial of service only.
Unauthenticated remote command execution in Commvault CVFS, the file system component shipped with Commvault Grid (HyperScale X) deployments and exposed through Commvault Cloud, allows a network-reachable attacker to execute commands on the underlying system with high impact to confidentiality, integrity, and availability - Commvault scores it 9.3 under CVSS 4.0. Per the vendor CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) the issue is remotely triggerable without credentials or user interaction, which makes any internet- or broadly reachable CVFS endpoint a priority exposure; the advisory does not name the specific feature, protocol endpoint, or configuration path that must be reached. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and a fixed maintenance release is available from Commvault.
Missing authentication on a command-execution path in Commvault CVFS (the file-system component used in Commvault Cloud and Grid HSX deployments) allows an attacker who already sits on the same network segment as the node to execute commands without supplying credentials or relying on any user action. The attack surface is deliberately narrow: successful exploitation requires adjacent-network reachability (AV:A) plus an additional attack precondition that is outside the attacker's direct control (AT:P), which is why the overall severity lands at 7.7 rather than critical despite high confidentiality, integrity, and availability impact on the affected host. Commvault has published a maintenance release that resolves the condition, and no public exploit code has been identified at the time of analysis; defenders should prioritise network segmentation of backup and storage subnets alongside the upgrade.
A null pointer dereference in Commvault's CvFWD network routing service crashes affected components, producing a denial-of-service condition limited to availability. The flaw is remotely reachable over the network but requires a low-privilege authenticated account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, assessed 7.1 severity), with no confidentiality or integrity exposure - no data is read, modified, or exfiltrated. Commvault has published a security advisory (CV_2026_10_5) directing customers to a resolved maintenance release covering CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the available intelligence. Because the impact is availability-only and gated behind authentication, the realistic risk is moderate rather than emergency-grade, though environments that expose CvFWD broadly or tolerate unplanned service restarts should prioritize patching.
An out-of-bounds write in Commvault's CvFWD network-communication daemon allows a low-privilege authenticated attacker who can reach the service over the network to crash it, producing a denial of service against the affected Commvault component. The flaw is availability-only (CVSS 4.0 7.1, VA:H with VC:N/VI:N) and offers no path to data disclosure or code execution; it affects Commvault Cloud deployments, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale, until the resolved maintenance release is applied. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
An integer overflow in CvFWD, the Commvault network-forwarding daemon used across Commvault Cloud deployments, lets a low-privilege authenticated attacker on the network crash or degrade the forwarding service, producing an availability-only denial of service with no confidentiality or integrity impact. All Commvault components that ship or communicate with CvFWD are in scope - CommServe, Web Server, Command Center, MediaAgents, Clients and HyperScale - so risk is highest in environments where these services are reachable from broad or untrusted network segments rather than restricted management networks. The vendor classifies this as a 7.1 (CVSS 4.0) issue requiring PR:L; there is no public exploit identified at time of analysis and no CISA KEV listing, and EPSS data was not provided, so the practical near-term driver is patch hygiene rather than active exploitation.
Unauthenticated remote attackers can exploit XML external entity (XXE) handling in Commvault's CVFS component to read files from the underlying host, resulting in high-confidentiality information disclosure (CVSS 4.0 8.7 HIGH; vendor vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N). Affected deployments are Commvault Cloud and Grid (HSX) CVFS instances, per the vendor's CPE data, that remain on a pre-fix maintenance release and expose an XML-accepting CVFS interface to the network. Integrity and availability are unaffected, and no public exploit has been identified at time of analysis; the primary practical barrier is whether the storage/backup management plane is network-reachable rather than confined to an internal segment.
Path traversal in Commvault HyperScale MediaAgents allows an authenticated low-privileged user to read files outside the intended directory over the network, resulting in unauthorized disclosure of data (rated 7.1, confidentiality-only impact with no integrity or availability effect). The flaw requires a valid session to the MediaAgent service (PR:L per the assessed vector), so anonymous internet attackers cannot trigger it - stolen, shared, or insider credentials are the realistic precondition. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Commvault reports that software customers should upgrade to the resolved maintenance release; exact affected versions and deployment modes should be confirmed against advisory CV_2026_10_8.
Missing authorization in the cvlaunchd daemon of Commvault Cloud allows low-privileged authenticated users to bypass command execution authorization controls, potentially achieving full system compromise across confidentiality, integrity, and availability dimensions. All major Commvault installation components are affected - Commserve, Webserver, Command Center, Media Agents, Clients, and HyperScale X - across four version branches (11.36, 11.40, 11.44, 11.46). No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment surface and high-impact CVSS profile make patching urgent for enterprise operators.
Cryptographic signature verification failure in Commvault Cloud's CommServe component enables authenticated low-privileged users to bypass privilege management controls, achieving full confidentiality, integrity, and availability impact against the CommServe system. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) confirms network exploitation at low complexity, requiring only a standard authenticated session - no administrator-level access needed. No public exploit or KEV listing is present at time of analysis, but Commvault has self-reported and released a maintenance patch, indicating vendor-confirmed severity.
Path traversal in Commvault CommServe allows unauthenticated remote attackers with sufficient complexity to read sensitive files outside intended directory boundaries, resulting in high-impact information disclosure. Affected versions span four active release trains of Commvault Cloud (11.36, 11.40, 11.44, 11.46), making this relevant across a broad enterprise backup customer base. No public exploit or active exploitation has been identified at time of analysis; vendor has released patched maintenance releases.
Unauthenticated remote access to Commvault Cloud's CommServe management server allows an attacker to bypass access authorization controls and disclose sensitive information. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms fully network-exposed, zero-prerequisite exploitation against the CommServe component across four active version branches (11.36.x, 11.40.x, 11.44.x, 11.46.x). Commvault has released maintenance updates and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the CommServe component of Commvault Cloud allows remote unauthenticated attackers to crash the CommServe service, causing denial of service to backup and recovery operations. Affected version branches span four maintenance tracks - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - all below their respective patched maintenance releases. No public exploit code or active exploitation has been identified at time of analysis, and Commvault has released fixed maintenance releases per advisory CV_2026_08_4.
Stack-based buffer overflow in the CommServe component of Commvault Cloud allows unauthenticated remote attackers to crash the service, causing a denial of service across all affected release trains (11.36.x, 11.40.x, 11.44.x, 11.46.x). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or special conditions are required to trigger the crash. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, and Commvault has released maintenance updates across all affected branches.
SQL injection in the Private Metrics Server component of Commvault Cloud allows unauthenticated remote attackers to read sensitive database contents and perform limited data manipulation via crafted inputs to affected database operations. All active Commvault Cloud release branches - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - are affected up to specific maintenance release cutpoints documented in vendor advisory CV_2026_08_2. Commvault has released maintenance updates resolving the condition; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated access to the Private Metrics Server component in Commvault Cloud allows network-adjacent or internet-facing attackers to interact with the metrics upload functionality without credentials. The CVSS 4.0 vector (PR:N, VA:H, VI:L) confirms the endpoint lacks authentication entirely, enabling service disruption and limited metrics data manipulation. No public exploit code has been identified at time of analysis, and the vendor has released a maintenance update resolving the condition.
Deserialization of untrusted data in Commvault Cloud's Content Extractor component enables privilege escalation, producing high impact across confidentiality, integrity, and availability of affected systems. The flaw targets the privilege management subsystem and requires local access with low-level credentials under specific environmental conditions (CVSS 4.0 AV:L/AC:H/AT:P/PR:L). Commvault has released a maintenance update resolving the issue; no public exploit code or active exploitation has been identified at the time of analysis.
Path traversal in Commvault Cloud's DataCube component allows a locally authenticated low-privileged attacker to bypass security feature enforcement, resulting in high-impact compromise of confidentiality, integrity, and availability on the affected system. The Content Extractor and Index Store sub-components are specifically identified as requiring remediation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was self-reported by Commvault with a fix available in a maintenance release.
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privilege management controls in Commvault Cloud deployments. Per the CVSS 4.0 vector (VC:H/VI:H/VA:H) an attacker can reach a fully-privileged state affecting confidentiality, integrity and availability without credentials or user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operations without passing the intended authorization checks, per Commvault security advisory CV_2026_07_9. The flaw carries a CVSS 4.0 base score of 9.2 with high impact to confidentiality, integrity, and availability, and affects Commvault Cloud deployments across the CommServe, Web Server, Command Center, MediaAgents, Clients, and HyperScale X components. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in Commvault CommServe permits attackers to circumvent the command-execution allowlist, gaining unsanctioned command execution across the backup-management control plane. Because CommServe orchestrates the entire Commvault environment, a successful bypass can cascade to Webservers, Command Center, Media Agents, Clients and HyperScale X, threatening confidentiality, integrity and availability of protected data. Rated CVSS 4.0 9.2 (critical) by Commvault; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated server-side request forgery in Commvault Command Center's legacy endpoint allows a remote, unauthenticated attacker to cause the server to issue HTTP requests to arbitrary URLs, exposing internal services, cloud metadata endpoints, and credentials accessible from the Command Center's privileged network position. All versions of Commvault Cloud are indicated as affected per wildcard CPE, with Commvault releasing a resolved maintenance release per advisory CV_2026_07_5. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the CVSS 4.0 score of 8.8 with no authentication or precondition requirements makes this a high-priority remediation target in enterprise environments.
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 40.3% and no vendor patch available.
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 49.6% and no vendor patch available.
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 83.1%.
Commvault Web Server allows authenticated remote attackers to create and execute webshells, exploited in the wild alongside CVE-2025-34028 for comprehensive backup infrastructure compromise.
Commvault Command Center Innovation Release allows unauthenticated remote code execution through path traversal in ZIP file upload handling, enabling malicious JSP deployment on the server.
The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting (XSS) attack. Proper management of this functionality helps ensure a secure and seamless user experience. [CVSS 5.4 MEDIUM]
During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal can occur such that an attempt to view a log file can. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to arbitrary code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 46.2%.
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized data in a cookie. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated remote attackers can exhaust resources and disrupt availability across Commvault Cloud deployments by sending specially crafted, highly compressed messages to the platform's network messaging layer. Affected components include the CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale nodes, meaning any deployment exposing the messaging service on the network is reachable under default configurations (PR:N, UI:N). Impact is confined to availability (service disruption/denial of service) with no confidentiality or integrity loss, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS data was not provided. Commvault has resolved the issue in a maintenance release and directs all customers to upgrade.
Denial of service against the QAPI service in Commvault Cloud can be triggered by an authenticated low-privilege user who sends a crafted request that overflows a stack buffer on CommServe, Web Server, Command Center, or Index Server. Per the vendor's advisory, exploitation is limited to service availability - there is no data disclosure, data tampering, or code execution impact (CVSS:4.0 vector VC:N/VI:N/VA:H, score 7.1), and the independent CVSS:3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) agrees that only availability is affected. Valid credentials are mandatory and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority availability issue rather than an emergency, but Commvault has directed customers to a resolved maintenance release.
A heap-based buffer overflow in Commvault MediaAgent (and the associated HyperScale deployment) can be triggered over the network by an unauthenticated attacker, causing the service to crash and denying backup/data-protection availability. The affected component is the MediaAgent service within Commvault Cloud; per the provided CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required, though exploitation depends on the attacker being able to reach the MediaAgent/HyperScale service port, so firewall-segmented backup networks are materially less exposed. Impact is confined to availability (VA:H, with VC:N/VI:N), and there is no public exploit identified at time of analysis; CISA KEV does not list this issue. The input assigns CVSS 4.0 base 8.7 (HIGH); the independent assessment scores it 7.5 (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and both agree the effect is denial of service only.
Unauthenticated remote command execution in Commvault CVFS, the file system component shipped with Commvault Grid (HyperScale X) deployments and exposed through Commvault Cloud, allows a network-reachable attacker to execute commands on the underlying system with high impact to confidentiality, integrity, and availability - Commvault scores it 9.3 under CVSS 4.0. Per the vendor CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) the issue is remotely triggerable without credentials or user interaction, which makes any internet- or broadly reachable CVFS endpoint a priority exposure; the advisory does not name the specific feature, protocol endpoint, or configuration path that must be reached. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and a fixed maintenance release is available from Commvault.
Missing authentication on a command-execution path in Commvault CVFS (the file-system component used in Commvault Cloud and Grid HSX deployments) allows an attacker who already sits on the same network segment as the node to execute commands without supplying credentials or relying on any user action. The attack surface is deliberately narrow: successful exploitation requires adjacent-network reachability (AV:A) plus an additional attack precondition that is outside the attacker's direct control (AT:P), which is why the overall severity lands at 7.7 rather than critical despite high confidentiality, integrity, and availability impact on the affected host. Commvault has published a maintenance release that resolves the condition, and no public exploit code has been identified at the time of analysis; defenders should prioritise network segmentation of backup and storage subnets alongside the upgrade.
A null pointer dereference in Commvault's CvFWD network routing service crashes affected components, producing a denial-of-service condition limited to availability. The flaw is remotely reachable over the network but requires a low-privilege authenticated account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, assessed 7.1 severity), with no confidentiality or integrity exposure - no data is read, modified, or exfiltrated. Commvault has published a security advisory (CV_2026_10_5) directing customers to a resolved maintenance release covering CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale; no public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the available intelligence. Because the impact is availability-only and gated behind authentication, the realistic risk is moderate rather than emergency-grade, though environments that expose CvFWD broadly or tolerate unplanned service restarts should prioritize patching.
An out-of-bounds write in Commvault's CvFWD network-communication daemon allows a low-privilege authenticated attacker who can reach the service over the network to crash it, producing a denial of service against the affected Commvault component. The flaw is availability-only (CVSS 4.0 7.1, VA:H with VC:N/VI:N) and offers no path to data disclosure or code execution; it affects Commvault Cloud deployments, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale, until the resolved maintenance release is applied. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
An integer overflow in CvFWD, the Commvault network-forwarding daemon used across Commvault Cloud deployments, lets a low-privilege authenticated attacker on the network crash or degrade the forwarding service, producing an availability-only denial of service with no confidentiality or integrity impact. All Commvault components that ship or communicate with CvFWD are in scope - CommServe, Web Server, Command Center, MediaAgents, Clients and HyperScale - so risk is highest in environments where these services are reachable from broad or untrusted network segments rather than restricted management networks. The vendor classifies this as a 7.1 (CVSS 4.0) issue requiring PR:L; there is no public exploit identified at time of analysis and no CISA KEV listing, and EPSS data was not provided, so the practical near-term driver is patch hygiene rather than active exploitation.
Unauthenticated remote attackers can exploit XML external entity (XXE) handling in Commvault's CVFS component to read files from the underlying host, resulting in high-confidentiality information disclosure (CVSS 4.0 8.7 HIGH; vendor vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N). Affected deployments are Commvault Cloud and Grid (HSX) CVFS instances, per the vendor's CPE data, that remain on a pre-fix maintenance release and expose an XML-accepting CVFS interface to the network. Integrity and availability are unaffected, and no public exploit has been identified at time of analysis; the primary practical barrier is whether the storage/backup management plane is network-reachable rather than confined to an internal segment.
Path traversal in Commvault HyperScale MediaAgents allows an authenticated low-privileged user to read files outside the intended directory over the network, resulting in unauthorized disclosure of data (rated 7.1, confidentiality-only impact with no integrity or availability effect). The flaw requires a valid session to the MediaAgent service (PR:L per the assessed vector), so anonymous internet attackers cannot trigger it - stolen, shared, or insider credentials are the realistic precondition. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Commvault reports that software customers should upgrade to the resolved maintenance release; exact affected versions and deployment modes should be confirmed against advisory CV_2026_10_8.
Missing authorization in the cvlaunchd daemon of Commvault Cloud allows low-privileged authenticated users to bypass command execution authorization controls, potentially achieving full system compromise across confidentiality, integrity, and availability dimensions. All major Commvault installation components are affected - Commserve, Webserver, Command Center, Media Agents, Clients, and HyperScale X - across four version branches (11.36, 11.40, 11.44, 11.46). No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment surface and high-impact CVSS profile make patching urgent for enterprise operators.
Cryptographic signature verification failure in Commvault Cloud's CommServe component enables authenticated low-privileged users to bypass privilege management controls, achieving full confidentiality, integrity, and availability impact against the CommServe system. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) confirms network exploitation at low complexity, requiring only a standard authenticated session - no administrator-level access needed. No public exploit or KEV listing is present at time of analysis, but Commvault has self-reported and released a maintenance patch, indicating vendor-confirmed severity.
Path traversal in Commvault CommServe allows unauthenticated remote attackers with sufficient complexity to read sensitive files outside intended directory boundaries, resulting in high-impact information disclosure. Affected versions span four active release trains of Commvault Cloud (11.36, 11.40, 11.44, 11.46), making this relevant across a broad enterprise backup customer base. No public exploit or active exploitation has been identified at time of analysis; vendor has released patched maintenance releases.
Unauthenticated remote access to Commvault Cloud's CommServe management server allows an attacker to bypass access authorization controls and disclose sensitive information. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms fully network-exposed, zero-prerequisite exploitation against the CommServe component across four active version branches (11.36.x, 11.40.x, 11.44.x, 11.46.x). Commvault has released maintenance updates and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the CommServe component of Commvault Cloud allows remote unauthenticated attackers to crash the CommServe service, causing denial of service to backup and recovery operations. Affected version branches span four maintenance tracks - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - all below their respective patched maintenance releases. No public exploit code or active exploitation has been identified at time of analysis, and Commvault has released fixed maintenance releases per advisory CV_2026_08_4.
Stack-based buffer overflow in the CommServe component of Commvault Cloud allows unauthenticated remote attackers to crash the service, causing a denial of service across all affected release trains (11.36.x, 11.40.x, 11.44.x, 11.46.x). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or special conditions are required to trigger the crash. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, and Commvault has released maintenance updates across all affected branches.
SQL injection in the Private Metrics Server component of Commvault Cloud allows unauthenticated remote attackers to read sensitive database contents and perform limited data manipulation via crafted inputs to affected database operations. All active Commvault Cloud release branches - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - are affected up to specific maintenance release cutpoints documented in vendor advisory CV_2026_08_2. Commvault has released maintenance updates resolving the condition; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated access to the Private Metrics Server component in Commvault Cloud allows network-adjacent or internet-facing attackers to interact with the metrics upload functionality without credentials. The CVSS 4.0 vector (PR:N, VA:H, VI:L) confirms the endpoint lacks authentication entirely, enabling service disruption and limited metrics data manipulation. No public exploit code has been identified at time of analysis, and the vendor has released a maintenance update resolving the condition.
Deserialization of untrusted data in Commvault Cloud's Content Extractor component enables privilege escalation, producing high impact across confidentiality, integrity, and availability of affected systems. The flaw targets the privilege management subsystem and requires local access with low-level credentials under specific environmental conditions (CVSS 4.0 AV:L/AC:H/AT:P/PR:L). Commvault has released a maintenance update resolving the issue; no public exploit code or active exploitation has been identified at the time of analysis.
Path traversal in Commvault Cloud's DataCube component allows a locally authenticated low-privileged attacker to bypass security feature enforcement, resulting in high-impact compromise of confidentiality, integrity, and availability on the affected system. The Content Extractor and Index Store sub-components are specifically identified as requiring remediation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was self-reported by Commvault with a fix available in a maintenance release.
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privilege management controls in Commvault Cloud deployments. Per the CVSS 4.0 vector (VC:H/VI:H/VA:H) an attacker can reach a fully-privileged state affecting confidentiality, integrity and availability without credentials or user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operations without passing the intended authorization checks, per Commvault security advisory CV_2026_07_9. The flaw carries a CVSS 4.0 base score of 9.2 with high impact to confidentiality, integrity, and availability, and affects Commvault Cloud deployments across the CommServe, Web Server, Command Center, MediaAgents, Clients, and HyperScale X components. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in Commvault CommServe permits attackers to circumvent the command-execution allowlist, gaining unsanctioned command execution across the backup-management control plane. Because CommServe orchestrates the entire Commvault environment, a successful bypass can cascade to Webservers, Command Center, Media Agents, Clients and HyperScale X, threatening confidentiality, integrity and availability of protected data. Rated CVSS 4.0 9.2 (critical) by Commvault; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated server-side request forgery in Commvault Command Center's legacy endpoint allows a remote, unauthenticated attacker to cause the server to issue HTTP requests to arbitrary URLs, exposing internal services, cloud metadata endpoints, and credentials accessible from the Command Center's privileged network position. All versions of Commvault Cloud are indicated as affected per wildcard CPE, with Commvault releasing a resolved maintenance release per advisory CV_2026_07_5. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the CVSS 4.0 score of 8.8 with no authentication or precondition requirements makes this a high-priority remediation target in enterprise environments.
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 40.3% and no vendor patch available.
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 49.6% and no vendor patch available.
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 83.1%.
Commvault Web Server allows authenticated remote attackers to create and execute webshells, exploited in the wild alongside CVE-2025-34028 for comprehensive backup infrastructure compromise.
Commvault Command Center Innovation Release allows unauthenticated remote code execution through path traversal in ZIP file upload handling, enabling malicious JSP deployment on the server.
The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting (XSS) attack. Proper management of this functionality helps ensure a secure and seamless user experience. [CVSS 5.4 MEDIUM]
During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal can occur such that an attempt to view a log file can. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to arbitrary code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 46.2%.
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized data in a cookie. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.