Commvault Cloud
Monthly
Missing authorization in the cvlaunchd daemon of Commvault Cloud allows low-privileged authenticated users to bypass command execution authorization controls, potentially achieving full system compromise across confidentiality, integrity, and availability dimensions. All major Commvault installation components are affected - Commserve, Webserver, Command Center, Media Agents, Clients, and HyperScale X - across four version branches (11.36, 11.40, 11.44, 11.46). No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment surface and high-impact CVSS profile make patching urgent for enterprise operators.
Cryptographic signature verification failure in Commvault Cloud's CommServe component enables authenticated low-privileged users to bypass privilege management controls, achieving full confidentiality, integrity, and availability impact against the CommServe system. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) confirms network exploitation at low complexity, requiring only a standard authenticated session - no administrator-level access needed. No public exploit or KEV listing is present at time of analysis, but Commvault has self-reported and released a maintenance patch, indicating vendor-confirmed severity.
Path traversal in Commvault CommServe allows unauthenticated remote attackers with sufficient complexity to read sensitive files outside intended directory boundaries, resulting in high-impact information disclosure. Affected versions span four active release trains of Commvault Cloud (11.36, 11.40, 11.44, 11.46), making this relevant across a broad enterprise backup customer base. No public exploit or active exploitation has been identified at time of analysis; vendor has released patched maintenance releases.
Unauthenticated remote access to Commvault Cloud's CommServe management server allows an attacker to bypass access authorization controls and disclose sensitive information. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms fully network-exposed, zero-prerequisite exploitation against the CommServe component across four active version branches (11.36.x, 11.40.x, 11.44.x, 11.46.x). Commvault has released maintenance updates and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the CommServe component of Commvault Cloud allows remote unauthenticated attackers to crash the CommServe service, causing denial of service to backup and recovery operations. Affected version branches span four maintenance tracks - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - all below their respective patched maintenance releases. No public exploit code or active exploitation has been identified at time of analysis, and Commvault has released fixed maintenance releases per advisory CV_2026_08_4.
Stack-based buffer overflow in the CommServe component of Commvault Cloud allows unauthenticated remote attackers to crash the service, causing a denial of service across all affected release trains (11.36.x, 11.40.x, 11.44.x, 11.46.x). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or special conditions are required to trigger the crash. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, and Commvault has released maintenance updates across all affected branches.
SQL injection in the Private Metrics Server component of Commvault Cloud allows unauthenticated remote attackers to read sensitive database contents and perform limited data manipulation via crafted inputs to affected database operations. All active Commvault Cloud release branches - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - are affected up to specific maintenance release cutpoints documented in vendor advisory CV_2026_08_2. Commvault has released maintenance updates resolving the condition; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated access to the Private Metrics Server component in Commvault Cloud allows network-adjacent or internet-facing attackers to interact with the metrics upload functionality without credentials. The CVSS 4.0 vector (PR:N, VA:H, VI:L) confirms the endpoint lacks authentication entirely, enabling service disruption and limited metrics data manipulation. No public exploit code has been identified at time of analysis, and the vendor has released a maintenance update resolving the condition.
Deserialization of untrusted data in Commvault Cloud's Content Extractor component enables privilege escalation, producing high impact across confidentiality, integrity, and availability of affected systems. The flaw targets the privilege management subsystem and requires local access with low-level credentials under specific environmental conditions (CVSS 4.0 AV:L/AC:H/AT:P/PR:L). Commvault has released a maintenance update resolving the issue; no public exploit code or active exploitation has been identified at the time of analysis.
Path traversal in Commvault Cloud's DataCube component allows a locally authenticated low-privileged attacker to bypass security feature enforcement, resulting in high-impact compromise of confidentiality, integrity, and availability on the affected system. The Content Extractor and Index Store sub-components are specifically identified as requiring remediation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was self-reported by Commvault with a fix available in a maintenance release.
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privilege management controls in Commvault Cloud deployments. Per the CVSS 4.0 vector (VC:H/VI:H/VA:H) an attacker can reach a fully-privileged state affecting confidentiality, integrity and availability without credentials or user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operations without passing the intended authorization checks, per Commvault security advisory CV_2026_07_9. The flaw carries a CVSS 4.0 base score of 9.2 with high impact to confidentiality, integrity, and availability, and affects Commvault Cloud deployments across the CommServe, Web Server, Command Center, MediaAgents, Clients, and HyperScale X components. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in Commvault CommServe permits attackers to circumvent the command-execution allowlist, gaining unsanctioned command execution across the backup-management control plane. Because CommServe orchestrates the entire Commvault environment, a successful bypass can cascade to Webservers, Command Center, Media Agents, Clients and HyperScale X, threatening confidentiality, integrity and availability of protected data. Rated CVSS 4.0 9.2 (critical) by Commvault; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated server-side request forgery in Commvault Command Center's legacy endpoint allows a remote, unauthenticated attacker to cause the server to issue HTTP requests to arbitrary URLs, exposing internal services, cloud metadata endpoints, and credentials accessible from the Command Center's privileged network position. All versions of Commvault Cloud are indicated as affected per wildcard CPE, with Commvault releasing a resolved maintenance release per advisory CV_2026_07_5. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the CVSS 4.0 score of 8.8 with no authentication or precondition requirements makes this a high-priority remediation target in enterprise environments.
Missing authorization in the cvlaunchd daemon of Commvault Cloud allows low-privileged authenticated users to bypass command execution authorization controls, potentially achieving full system compromise across confidentiality, integrity, and availability dimensions. All major Commvault installation components are affected - Commserve, Webserver, Command Center, Media Agents, Clients, and HyperScale X - across four version branches (11.36, 11.40, 11.44, 11.46). No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment surface and high-impact CVSS profile make patching urgent for enterprise operators.
Cryptographic signature verification failure in Commvault Cloud's CommServe component enables authenticated low-privileged users to bypass privilege management controls, achieving full confidentiality, integrity, and availability impact against the CommServe system. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) confirms network exploitation at low complexity, requiring only a standard authenticated session - no administrator-level access needed. No public exploit or KEV listing is present at time of analysis, but Commvault has self-reported and released a maintenance patch, indicating vendor-confirmed severity.
Path traversal in Commvault CommServe allows unauthenticated remote attackers with sufficient complexity to read sensitive files outside intended directory boundaries, resulting in high-impact information disclosure. Affected versions span four active release trains of Commvault Cloud (11.36, 11.40, 11.44, 11.46), making this relevant across a broad enterprise backup customer base. No public exploit or active exploitation has been identified at time of analysis; vendor has released patched maintenance releases.
Unauthenticated remote access to Commvault Cloud's CommServe management server allows an attacker to bypass access authorization controls and disclose sensitive information. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms fully network-exposed, zero-prerequisite exploitation against the CommServe component across four active version branches (11.36.x, 11.40.x, 11.44.x, 11.46.x). Commvault has released maintenance updates and no public exploit has been identified at time of analysis.
Heap-based buffer overflow in the CommServe component of Commvault Cloud allows remote unauthenticated attackers to crash the CommServe service, causing denial of service to backup and recovery operations. Affected version branches span four maintenance tracks - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - all below their respective patched maintenance releases. No public exploit code or active exploitation has been identified at time of analysis, and Commvault has released fixed maintenance releases per advisory CV_2026_08_4.
Stack-based buffer overflow in the CommServe component of Commvault Cloud allows unauthenticated remote attackers to crash the service, causing a denial of service across all affected release trains (11.36.x, 11.40.x, 11.44.x, 11.46.x). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication or special conditions are required to trigger the crash. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, and Commvault has released maintenance updates across all affected branches.
SQL injection in the Private Metrics Server component of Commvault Cloud allows unauthenticated remote attackers to read sensitive database contents and perform limited data manipulation via crafted inputs to affected database operations. All active Commvault Cloud release branches - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - are affected up to specific maintenance release cutpoints documented in vendor advisory CV_2026_08_2. Commvault has released maintenance updates resolving the condition; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated access to the Private Metrics Server component in Commvault Cloud allows network-adjacent or internet-facing attackers to interact with the metrics upload functionality without credentials. The CVSS 4.0 vector (PR:N, VA:H, VI:L) confirms the endpoint lacks authentication entirely, enabling service disruption and limited metrics data manipulation. No public exploit code has been identified at time of analysis, and the vendor has released a maintenance update resolving the condition.
Deserialization of untrusted data in Commvault Cloud's Content Extractor component enables privilege escalation, producing high impact across confidentiality, integrity, and availability of affected systems. The flaw targets the privilege management subsystem and requires local access with low-level credentials under specific environmental conditions (CVSS 4.0 AV:L/AC:H/AT:P/PR:L). Commvault has released a maintenance update resolving the issue; no public exploit code or active exploitation has been identified at the time of analysis.
Path traversal in Commvault Cloud's DataCube component allows a locally authenticated low-privileged attacker to bypass security feature enforcement, resulting in high-impact compromise of confidentiality, integrity, and availability on the affected system. The Content Extractor and Index Store sub-components are specifically identified as requiring remediation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was self-reported by Commvault with a fix available in a maintenance release.
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privilege management controls in Commvault Cloud deployments. Per the CVSS 4.0 vector (VC:H/VI:H/VA:H) an attacker can reach a fully-privileged state affecting confidentiality, integrity and availability without credentials or user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operations without passing the intended authorization checks, per Commvault security advisory CV_2026_07_9. The flaw carries a CVSS 4.0 base score of 9.2 with high impact to confidentiality, integrity, and availability, and affects Commvault Cloud deployments across the CommServe, Web Server, Command Center, MediaAgents, Clients, and HyperScale X components. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in Commvault CommServe permits attackers to circumvent the command-execution allowlist, gaining unsanctioned command execution across the backup-management control plane. Because CommServe orchestrates the entire Commvault environment, a successful bypass can cascade to Webservers, Command Center, Media Agents, Clients and HyperScale X, threatening confidentiality, integrity and availability of protected data. Rated CVSS 4.0 9.2 (critical) by Commvault; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated server-side request forgery in Commvault Command Center's legacy endpoint allows a remote, unauthenticated attacker to cause the server to issue HTTP requests to arbitrary URLs, exposing internal services, cloud metadata endpoints, and credentials accessible from the Command Center's privileged network position. All versions of Commvault Cloud are indicated as affected per wildcard CPE, with Commvault releasing a resolved maintenance release per advisory CV_2026_07_5. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the CVSS 4.0 score of 8.8 with no authentication or precondition requirements makes this a high-priority remediation target in enterprise environments.