Commvault Security Advisories & CVEs
9 advisories tracked · Commvault Cloud Security Advisories · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Commvault CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Check if your Commvault device is affected
Pick your product and enter the exact software release it runs. We match it against the affected/fixed versions in Commvault's recent advisories.
Official source
Commvault Cloud Security Advisories
Polled by parsing the official Commvault security-advisories index (documentation.commvault.com), which lists every CV_YYYY_MM_N advisory with its CVEs and dates. Advisory pages are fetched for new items to extract severity, impacted products and the Feature Release / Maintenance Release fix table.
Latest Commvault advisories
Medium CVFS Information Disclosure
CVFS contained a missing authentication condition affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CVFS.CVSS score: 6.9 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux 11.46.0 - 11.46.29 11.46.30 and higher Resolved Commvault Linux 11.44.0 - 11.44.24 11.44.25 and higher Resolved Commvault Linux 11.40.0 - 11.40.77 11.40.78 and higher Resolved Commvault Linux 11.36.0 - 11.36.126 11.36.127 and higher Resolved Grid(HSX) CVFS Linux 5.0.1.0 - 5.0.14.4 5.0.14.5 and higher Resolved
Medium Content Extractor Information Disclosure
Content Extractor contained an external control of file name or path issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Content Extractor.CVSS: 6.8 Commvault Software To view version support lifecyle, see Commvault software releases, release types, and release tracks. Supported versions not listed are unaffected. Unsupported versions must be upgraded. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.46.0 - 11.46.19 11.46.20 and higher Resolved Commvault Linux, Windows 11.44.0 - 11.44.19 11.44.20 and higher Resolved Commvault Linux, Windows 11.40.0 - 11.40.71 11.40.72 and higher Resolved Commvault Linux, Windows 11.36.0 - 11.36.122 11.36.123 and higher Resolved
Medium [CVE-2025-57788] Unauthorized API Access Risk
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.CVSS Score: 6.9 Medium Commvault Software The following versions are impacted. Versions that are not listed are either out of support or unaffected. To view version support lifecyle, see Platform Release Schedule and Lifecycles. Product Platforms Affected Versions Resolved Version Status Commvault Linux, Windows 11.32.0 - 11.32.101 11.32.102 Resolved Commvault Linux, Windows 11.36.0 - 11.36.59 11.36.60 Resolved
Medium [CVE-2025-57791] Argument Injection Vulnerability in CommServe
Argument Injection Vulnerability in CommServe
Medium [CVE-2025-57789] Vulnerability in Initial Administrator Login Process
Vulnerability in Initial Administrator Login Process
Medium SQL Injection Vulnerability
Save as PDF A security vulnerability has been identified in the CommServe and Web Server installation that allows a remote SQL Injection attack without authentication. Other installations in the same system are not compromised by this vulnerability.CVSS Score: 5.5
Medium DLL Injection Vulnerability in the Software Installation Path
DLL Injection Vulnerability in the Software Installation Path
Medium Security vulnerability in Windows access nodes that are used for file server data protection
Security vulnerability in Windows access nodes that are used for file server data protection
Medium Authentication Bypass Vulnerabilities on CVWebService Endpoint
Authentication Bypass Vulnerabilities on CVWebService Endpoint