Commvault Security Advisories & CVEs
23 advisories tracked · Commvault Cloud Security Advisories · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Commvault CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Check if your Commvault device is affected
Pick your product and enter the exact software release it runs. We match it against the affected/fixed versions in Commvault's recent advisories.
Official source
Commvault Cloud Security Advisories
Polled by parsing the official Commvault security-advisories index (documentation.commvault.com), which lists every CV_YYYY_MM_N advisory with its CVEs and dates. Advisory pages are fetched for new items to extract severity, impacted products and the Feature Release / Maintenance Release fix table.
Latest Commvault advisories
High [CVE-2026-77090] CVFS Information Disclosure
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.CVSS: 8.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux 11.36.0 - 11.36.126 11.36.127 and higher Resolved Grid(HSX) CVFS Linux 5.0.1.0 - 5.0.14.4 5.0.14.5 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77093] CvFWD Denial of Service
CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.CVSS score: 7.1 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.126 11.36.127 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77094] CvFWD Out-of-Bounds Write
CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.CVSS score: 7.1 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.126 11.36.127 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77095] CvFWD Null Pointer Dereference
CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, MediaAgents, Clients and HyperScale.CVSS score: 7.1 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.126 11.36.127 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77096] CVFS Missing Authentication
CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.CVSS score: 7.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux 11.46.0 - 11.46.39 11.46.40 and higher Resolved Commvault Linux 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux 11.36.0 - 11.36.126 11.36.127 and higher Resolved Grid(HSX) CVFS Linux 5.0.1.0 - 5.0.14.4 5.0.14.5 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77100] Media Agent Denial of Service
Media Agent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.CVSS score: 8.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.126 11.36.127 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-18228] HyperScale Path Traversal
HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale Media Agents.CVSS Score: 7.1 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux 11.36.0 - 11.36.126 11.36.127 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-97333] QAPI stack-based buffer overflow
QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server. CVSS score: 7.1 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.126 11.36.127 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-97334] Network messaging layer decompression resource exhaustion
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale. CVSS: 8.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.126 11.36.127 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77103] CommServe Information Disclosure
CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.CVSS score: 8.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77091] DataCube Security Feature Bypass
DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.CVSS: 8.5 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77106] Cvlaunchd Code Execution
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.CVSS Score: 7.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77105] CommServe Privilege Escalation
CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server.CVSS score: 8.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77104] CommServe Path Traversal
CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.CVSS score: 8.3 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77102] CommServe Denial of Service
CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.CVSS score: 8.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77101] CommServe Stack-based Buffer Overflow
CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.CVSS score: 8.7 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77098] Private Metrics Server SQL Injection
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.CVSS score: 8.8 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77097] Private Metrics Server Denial of Service
Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.CVSS score: 8.8 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-77092] Content Extractor Privilege Escalation
Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.CVSS: 7.3 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved Affected product named by the advisory: Commvault Cloud.
High [CVE-2026-13739] Server-Side Request Forgery (SSRF)
A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs.Software customers upgrade to resolved maintenance release.CVSS score: 8.8 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Versions not listed are out of support or unaffected. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.9 11.46.10 and above Resolved Commvault Linux, Windows 11.44.0 - 11.44.10 11.44.11 and above Resolved Commvault Linux, Windows 11.40.0 - 11.40.62 11.40.63 and above Resolved Commvault Linux, Windows 11.36.0 - 11.36.113 11.36.114 and above Resolved Affected product named by the advisory: Commvault Cloud.