CVE-2026-97334: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) in Commvault Commvault Cloud

The vulnerability identified as CVE-2026-97334 (CWE-409) affects the network messaging layer of Commvault Cloud products. It involves improper handling of highly compressed data, leading to data amplification that impacts service availability. The issue affects several versions of Commvault software, specifically versions >=11.46.0 and <11.46.30, >=11.44.0 and <11.44.25, >=11.40.0 and <11.40.78, and >=11.36.0 and <11.36.127. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low complexity, no privileges or user interaction required, and high impact on availability.

Exploitation of this vulnerability can lead to denial of service conditions by impacting the availability of Commvault Cloud services through data amplification caused by improper handling of highly compressed data. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild at this time.

A fix is available through resolved maintenance releases. Customers should upgrade all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale, to the fixed versions. Specific patch links were not provided, so users should consult official Commvault advisories or support channels for the exact update packages.