This vulnerability (CVE-2026-77103) in Commvault Commvault Cloud's CommServe involves an authentication bypass due to an alternate path or channel, classified under CWE-288. It impacts access authorization and can result in information disclosure. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality. The affected versions explicitly include 11.36.0, 11.40.0, 11.44.0, and 11.46.0. No official remediation level or patch links are provided in the data, and no known exploits are reported in the wild.

Successful exploitation allows an attacker to bypass authentication controls in CommServe, potentially gaining unauthorized access to sensitive information. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector. The vulnerability is exploitable remotely without authentication or user interaction.

The vendor advises upgrading CommServe to a resolved maintenance release to fix this issue. Since no specific patch or remediation level is provided, customers should consult Commvault's official advisories for the exact fixed versions and apply updates accordingly. Patch status is not yet confirmed in the provided data — check the vendor advisory for current remediation guidance.