Commvault Commvault Cloud (Metallic) Vulnerabilities & Security Advisories
25 advisories tracked · Commvault Cloud Security Advisories · 0 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Commvault advisory that VulniPulse classified as Commvault Cloud (Metallic), with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 5 critical, 20 high.
Android app · Google Play
Monitor Commvault CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Commvault Cloud Security Advisories
Polled by parsing the official Commvault security-advisories index (documentation.commvault.com), which lists every CV_YYYY_MM_N advisory with its CVEs and dates. Advisory pages are fetched for new items to extract severity, impacted products and the Feature Release / Maintenance Release fix table.
Latest Commvault Commvault Cloud (Metallic) advisories
Critical [CVE-2026-77099] CVFS Command Execution
CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.CVSS score: 9.3 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux 11.36.0 - 11.36.126 11.36.127 and higher Resolved Grid(HSX) CVFS Linux 5.0.1.0 - 5.0.14.4 5.0.14.5 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77090] CVFS Information Disclosure
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.CVSS: 8.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux 11.36.0 - 11.36.126 11.36.127 and higher Resolved Grid(HSX) CVFS Linux 5.0.1.0 - 5.0.14.4 5.0.14.5 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77093] CvFWD Denial of Service
CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.CVSS score: 7.1 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.126 11.36.127 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77094] CvFWD Out-of-Bounds Write
CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.CVSS score: 7.1 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.126 11.36.127 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77095] CvFWD Null Pointer Dereference
CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, MediaAgents, Clients and HyperScale.CVSS score: 7.1 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.126 11.36.127 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77096] CVFS Missing Authentication
CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.CVSS score: 7.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux 11.46.0 - 11.46.39 11.46.40 and higher Resolved Commvault Linux 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux 11.36.0 - 11.36.126 11.36.127 and higher Resolved Grid(HSX) CVFS Linux 5.0.1.0 - 5.0.14.4 5.0.14.5 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77100] Media Agent Denial of Service
Media Agent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.CVSS score: 8.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.126 11.36.127 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-18228] HyperScale Path Traversal
HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale Media Agents.CVSS Score: 7.1 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux 11.36.0 - 11.36.126 11.36.127 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-97333] QAPI stack-based buffer overflow
QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server. CVSS score: 7.1 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.126 11.36.127 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-97334] Network messaging layer decompression resource exhaustion
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale. CVSS: 8.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.126 11.36.127 and higher Resolved Affected product named by the advisory: Commvault Cloud.
Critical [CVE-2026-77089] Command Center API Authentication Bypass
Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.CVSS: 9.3 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77103] CommServe Information Disclosure
CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.CVSS score: 8.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77091] DataCube Security Feature Bypass
DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.CVSS: 8.5 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77106] Cvlaunchd Code Execution
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.CVSS Score: 7.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77105] CommServe Privilege Escalation
CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server.CVSS score: 8.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77104] CommServe Path Traversal
CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.CVSS score: 8.3 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77102] CommServe Denial of Service
CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.CVSS score: 8.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77101] CommServe Stack-based Buffer Overflow
CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.CVSS score: 8.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77098] Private Metrics Server SQL Injection
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.CVSS score: 8.8 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77097] Private Metrics Server Denial of Service
Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.CVSS score: 8.8 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.