CVE-2026-77096: CWE-306: Missing Authentication for Critical Function in Commvault Commvault Cloud

The vulnerability identified as CVE-2026-77096 involves a missing authentication condition in the CVFS component of Commvault Cloud, which impacts command execution functionality. This flaw is classified under CWE-306 (Missing Authentication for Critical Function). The vulnerability affects several version ranges of Commvault Cloud, specifically versions >=11.46.0 and <11.46.40, >=11.44.0 and <11.44.25, >=11.40.0 and <11.40.78, >=11.36.0 and <11.36.127, and >=5.0.1.0 and <5.0.14.5. The CVSS v4.0 base score is 7.7, indicating high severity, with attack vector as adjacent network, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advises customers to upgrade to a resolved maintenance release to address the issue.

The vulnerability allows unauthorized command execution due to missing authentication in a critical function within the CVFS component. This can lead to significant compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 7.7 reflects a high impact with potential for serious operational disruption if exploited.

Customers should upgrade to the resolved maintenance releases of Commvault Cloud that address this vulnerability. Since the vendor advisory explicitly recommends upgrading to fixed versions, applying these updates is the primary mitigation. Patch status is confirmed by the vendor's recommendation to upgrade; no additional temporary mitigations are indicated.