This vulnerability (CWE-306) involves the Private Metrics Server component of Commvault Cloud lacking proper authentication controls for its metrics upload functionality. This missing authentication could allow unauthorized access to critical functions, affecting the availability of the service. The CVSS 4.0 base score is 8.8, indicating a high severity with network attack vector, no privileges or user interaction required, and high impact on availability. The vendor recommends upgrading to a maintenance release that resolves this issue, although no explicit patch or fixed version details are provided in the available data.

The vulnerability allows unauthenticated attackers to access critical metrics upload functions, which can lead to disruption or degradation of service availability. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild at this time.

Customers should upgrade to the maintenance release that resolves this vulnerability as recommended by the vendor. Since no specific patch version or advisory is provided, users must consult Commvault's official channels for the exact fixed release. Until then, monitoring and restricting access to the Private Metrics Server may reduce exposure.