Threat database

The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.

QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.

MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.

CVE-2026-77099 is a critical OS command injection vulnerability in Commvault Cloud's CVFS component caused by improper input validation. This flaw allows unauthenticated attackers to execute arbitrary OS commands with high impact on confidentiality, integrity, and availability. Multiple versions of Commvault Cloud prior to specific maintenance releases are affected. Users are advised to upgrade to the resolved maintenance releases to mitigate this issue.

CVE-2026-77096 is a high-severity vulnerability in Commvault Cloud's CVFS component caused by missing authentication for a critical function, allowing unauthorized command execution. The issue affects multiple versions prior to specific maintenance releases. Customers are advised to upgrade to the resolved maintenance releases to mitigate the risk.

CVE-2026-77095 is a high-severity vulnerability in Commvault Cloud involving a NULL pointer dereference that affects service availability. It impacts multiple Commvault components including CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale. The issue is resolved in maintenance releases, and users are advised to upgrade to these fixed versions.

CVE-2026-77094 is an out-of-bounds write vulnerability (CWE-787) in Commvault Cloud's CvFWD component that can affect service availability. The issue impacts multiple Commvault software components including CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale. Customers are advised to upgrade to the resolved maintenance releases to mitigate the vulnerability. The CVSS 4.0 base score is 7.1, indicating a high severity level.

CVE-2026-77093 is an integer overflow vulnerability (CWE-190) in Commvault Commvault Cloud components that can affect service availability. The issue impacts multiple Commvault software components including CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale. The vulnerability has a high severity with a CVSS 4.0 base score of 7.1. Users are advised to upgrade to the resolved maintenance releases to mitigate the issue.

CVE-2026-77090 is a high-severity vulnerability in Commvault Cloud's CVFS component involving improper restriction of XML External Entity (XXE) references. This flaw can lead to information disclosure. Multiple versions of Commvault Cloud CVFS prior to specific maintenance releases are affected. Users are advised to upgrade to the resolved maintenance releases to mitigate the issue.

CVE-2026-18228 is a path traversal vulnerability in Commvault Commvault Cloud's HyperScale MediaAgents that could lead to information disclosure. The issue arises from improper limitation of a pathname to a restricted directory. It affects multiple versions of the software prior to specific maintenance releases. The vulnerability has a high severity score of 7.1. Users are advised to upgrade to the resolved maintenance releases to mitigate the risk.

CVE-2026-77106 is a high-severity vulnerability in Commvault Cloud involving a missing authorization check in the cvlaunchd component. This flaw affects command execution authorization, potentially allowing unauthorized actions. Multiple Commvault components including Commserve, Webserver, Command Center, Media Agents, Clients, and HyperScale X are impacted. Users are advised to upgrade to the resolved maintenance releases to mitigate the issue.

CVE-2026-77105 is a high-severity vulnerability in Commvault Commvault Cloud's CommServe component involving improper verification of cryptographic signatures related to privilege management. This flaw could allow an attacker to bypass certain privilege restrictions. The vendor advises upgrading to a resolved maintenance release to address the issue.

CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.

CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.

Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.

DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.