CVE-2026-77094: CWE-787: Out-of-bounds Write in Commvault Commvault Cloud

This vulnerability, identified as CWE-787 (Out-of-bounds Write), affects the CvFWD component of Commvault Cloud software. The flaw can lead to service availability issues due to improper memory handling. The affected versions include Commvault Cloud releases from 11.36.0 up to but not including 11.36.127, 11.40.0 up to but not including 11.40.78, 11.44.0 up to but not including 11.44.25, and 11.46.0 up to but not including 11.46.30. The CVSS 4.0 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required beyond low, no user interaction, and high impact on availability.

Successful exploitation of this out-of-bounds write vulnerability can disrupt service availability of Commvault Cloud components, potentially causing denial of service conditions. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild at this time.

Software customers should upgrade all Commvault installations—including CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale—to the resolved maintenance releases that address this vulnerability. Since the vendor advisory explicitly instructs upgrading to fixed versions, this is the recommended remediation. Patch status is confirmed by the vendor's instruction to upgrade to resolved maintenance releases.