This vulnerability (CVE-2026-13739) is classified as CWE-918 (Server-Side Request Forgery) and exists in a legacy endpoint of Commvault Commvault Cloud's Command Center. The flaw allows unauthenticated attackers to exploit the handling of arbitrary target URLs, potentially causing the server to send crafted requests to internal or external systems. The CVSS 4.0 base score is 8.8, indicating high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality. The vulnerability affects versions 11.36.0, 11.40.0, 11.44.0, and 11.46.0 of the product. No official remediation level or patch links are provided in the data, but customers are advised to upgrade to a resolved maintenance release.

An unauthenticated attacker can exploit this SSRF vulnerability to make the server perform arbitrary requests, which could lead to information disclosure or interaction with internal systems not otherwise accessible. The high CVSS score reflects significant confidentiality impact and ease of exploitation without authentication or user interaction.

Customers should update Command Center to the resolved maintenance release as recommended by the vendor. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for the latest remediation guidance. No temporary or official fix details are provided here.