Grid Hsx Cvfs
Monthly
Unauthenticated remote command execution in Commvault CVFS, the file system component shipped with Commvault Grid (HyperScale X) deployments and exposed through Commvault Cloud, allows a network-reachable attacker to execute commands on the underlying system with high impact to confidentiality, integrity, and availability - Commvault scores it 9.3 under CVSS 4.0. Per the vendor CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) the issue is remotely triggerable without credentials or user interaction, which makes any internet- or broadly reachable CVFS endpoint a priority exposure; the advisory does not name the specific feature, protocol endpoint, or configuration path that must be reached. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and a fixed maintenance release is available from Commvault.
Missing authentication on a command-execution path in Commvault CVFS (the file-system component used in Commvault Cloud and Grid HSX deployments) allows an attacker who already sits on the same network segment as the node to execute commands without supplying credentials or relying on any user action. The attack surface is deliberately narrow: successful exploitation requires adjacent-network reachability (AV:A) plus an additional attack precondition that is outside the attacker's direct control (AT:P), which is why the overall severity lands at 7.7 rather than critical despite high confidentiality, integrity, and availability impact on the affected host. Commvault has published a maintenance release that resolves the condition, and no public exploit code has been identified at the time of analysis; defenders should prioritise network segmentation of backup and storage subnets alongside the upgrade.
Unauthenticated remote attackers can exploit XML external entity (XXE) handling in Commvault's CVFS component to read files from the underlying host, resulting in high-confidentiality information disclosure (CVSS 4.0 8.7 HIGH; vendor vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N). Affected deployments are Commvault Cloud and Grid (HSX) CVFS instances, per the vendor's CPE data, that remain on a pre-fix maintenance release and expose an XML-accepting CVFS interface to the network. Integrity and availability are unaffected, and no public exploit has been identified at time of analysis; the primary practical barrier is whether the storage/backup management plane is network-reachable rather than confined to an internal segment.
Unauthenticated remote command execution in Commvault CVFS, the file system component shipped with Commvault Grid (HyperScale X) deployments and exposed through Commvault Cloud, allows a network-reachable attacker to execute commands on the underlying system with high impact to confidentiality, integrity, and availability - Commvault scores it 9.3 under CVSS 4.0. Per the vendor CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) the issue is remotely triggerable without credentials or user interaction, which makes any internet- or broadly reachable CVFS endpoint a priority exposure; the advisory does not name the specific feature, protocol endpoint, or configuration path that must be reached. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and a fixed maintenance release is available from Commvault.
Missing authentication on a command-execution path in Commvault CVFS (the file-system component used in Commvault Cloud and Grid HSX deployments) allows an attacker who already sits on the same network segment as the node to execute commands without supplying credentials or relying on any user action. The attack surface is deliberately narrow: successful exploitation requires adjacent-network reachability (AV:A) plus an additional attack precondition that is outside the attacker's direct control (AT:P), which is why the overall severity lands at 7.7 rather than critical despite high confidentiality, integrity, and availability impact on the affected host. Commvault has published a maintenance release that resolves the condition, and no public exploit code has been identified at the time of analysis; defenders should prioritise network segmentation of backup and storage subnets alongside the upgrade.
Unauthenticated remote attackers can exploit XML external entity (XXE) handling in Commvault's CVFS component to read files from the underlying host, resulting in high-confidentiality information disclosure (CVSS 4.0 8.7 HIGH; vendor vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N). Affected deployments are Commvault Cloud and Grid (HSX) CVFS instances, per the vendor's CPE data, that remain on a pre-fix maintenance release and expose an XML-accepting CVFS interface to the network. Integrity and availability are unaffected, and no public exploit has been identified at time of analysis; the primary practical barrier is whether the storage/backup management plane is network-reachable rather than confined to an internal segment.