CVE-2026-77090: CWE-611: Improper Restriction of XML External Entity Reference in Commvault Commvault Cloud
Description
CVE-2026-77090 is a high-severity vulnerability in Commvault Commvault Cloud involving improper restriction of XML external entity (XXE) references. This flaw in the CVFS component can lead to information disclosure. Multiple versions of the software prior to specific maintenance releases are affected. Users are advised to upgrade to the resolved maintenance releases to mitigate the issue.
CVSS v4.0
Score 8.7high
Affected software
Commvault
Commvault Cloud
Commvault
Grid(HSX) CVFS
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability, identified as CWE-611, concerns improper handling of XML external entity references in the CVFS component of Commvault Commvault Cloud. The flaw allows an attacker to exploit XXE processing to disclose sensitive information. The CVSS 4.0 score is 8.7, indicating a high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality. Affected versions include multiple release ranges prior to maintenance updates. The vendor recommends upgrading to the resolved maintenance releases to address the issue.
Potential Impact
Successful exploitation of this vulnerability can lead to information disclosure without requiring authentication or user interaction. The vulnerability affects confidentiality but does not impact integrity or availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Users should upgrade to the resolved maintenance releases of Commvault Commvault Cloud CVFS component as recommended by the vendor. Patch status is not explicitly stated in the input data, but the advisory instructs upgrading to fixed versions. No additional mitigation steps are provided or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Commvault
- Date Reserved
- 2026-08-20T10:56:58.070Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ace415e2cdf04f656747db7
Added to database: 10/13/2026, 14:34:06 UTC
Last enriched: 10/13/2026, 14:49:23 UTC
Last updated: 10/13/2026, 18:57:33 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.