CVE-2026-77092: Commvault Content Extractor Privilege Escalation
This Commvault advisory covers CVE-2026-77092 in Commvault Cloud.
- CVE-2026-77092
Key facts
- Vendor rating
- High, CVSS 7.3
- CISA KEV
- Not listed (catalogue checked )
- Affected
- Affected Versions; 11.46.0 - 11.46.19; 11.44.0 - 11.44.19 and 2 more below
- Fixed in
- 11.46.20, 11.44.20, 11.40.72 and 1 more below
- Advisory id
- CV_2026_07_6
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release.
Update Content Extractor.CVSS: 7.3 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected.
Unsupported versions must be upgraded.
Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved
Affected product named by the advisory: Commvault Cloud.
Text from the source record.
- Affected Versions
- 11.46.0 - 11.46.19
- 11.44.0 - 11.44.19
- 11.40.0 - 11.40.71
- 11.36.0 - 11.36.122
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-77092
Upgrade to a fixed release named by Commvault:
- 11.46.20
- 11.44.20
- 11.40.72
- 11.36.123
Vendor guidance
- Install the listed maintenance release (or a more recent one) for your feature release: 11.46.20, 11.44.20, 11.40.72, 11.36.123.
More Commvault advisories
CVE-2026-97334Oct 13, 2026Network messaging layer decompression resource exhaustionCVE-2026-97333Oct 13, 2026QAPI stack-based buffer overflowCVE-2026-18228Oct 13, 2026HyperScale Path TraversalCVE-2026-77100Oct 13, 2026Media Agent Denial of ServiceCVE-2026-77099Oct 13, 2026CVFS Command ExecutionCVE-2026-77096Oct 13, 2026CVFS Missing Authentication
Commvault advisories, September 2026All Commvault advisories
Get an email when Commvault Cloud (Metallic) publishes the next one.
See Commvault Cloud (Metallic)'s last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Commvault CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
