Skip to content
OpenAdvisories

Vendor

Commvault

40 known vulnerabilities.

Commvault at a glance

Last 12 months
25
Critical · all time
6
Exploited · all time
2
Public exploit · all time
5
New vulnerabilities per month · last 12 months
0 10 20 December 2025: 0 vulnerabilities Dec 2025 January 2026: 1 vulnerability February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 3 vulnerabilities, 2 critical September 2026: 11 vulnerabilities, 1 critical Sep October 2026: 10 vulnerabilities, 1 critical November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 2026101
Sep 2026111
Aug 202632
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202610
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202540
Jul 202530
Jun 202500
May 202500
Apr 202521
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Commvault Cloud 24 CommCell 9 Grid(HSX) CVFS 3 Commvault 2 Web Server 1 Service Pack 6 1 WebConsole 1 Commvault for Windows 1 Command Center Innovation Release 1 Command Center 0 Backup & Recovery 0

Latest advisories

  • High max 9.2
    WID-SEC-2026-2767 3 CVEs

    Commvault Backup & Recovery: Mehrere Schwachstellen

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Commvault Backup & Recovery ausnutzen, um Sicherheitsvorkehrungen zu umgehen, beliebigen Code auszuführen und serverseitige Request-Forgery-Angriffe durchzuführen

    Commvault Windows
  • High max 7.5
    WID-SEC-2025-2905 1 CVE 1 exploited rev. 6

    MongoDB: Schwachstelle ermöglicht Offenlegung von Informationen

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in MongoDB ausnutzen, um Informationen offenzulegen.

    Splunk Commvault Ubuntu Linux Windows
    first Dec 18, 2025
  • Low
    WID-SEC-2026-0563 0 CVEs

    Commvault Backup & Recovery: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

    Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Commvault Backup & Recovery ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

    Commvault Linux Windows
  • High max 8.7
    WID-SEC-2025-1867 4 CVEs rev. 2

    Commvault Backup & Recovery: Mehrere Schwachstellen

    Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Commvault Backup & Recovery ausnutzen, um sich erweiterte Berechtigungen zu verschaffen, beliebigen Code auszuführen und Sicherheitsmaßnahmen zu umgehen.

    Commvault Windows
    first Aug 19, 2025
  • High max 8.7
    NCSC-2025-0265 3 CVEs

    Kwetsbaarheden verholpen in Commvault

    Commvault heeft kwetsbaarheden verholpen in Commvault componenten als CommCell en ComServe versies voor 11.36.60.

    Commvault
All Critical High Medium Low Exploited only Public exploit

40 results · Feed

  • High 8.7
    CVE-2026-77100

    MediaAgent Denial of Service

    MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-97334

    Network messaging layer decompression resource exhaustion

    The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command C…

    Commvault Commvault Cloud
  • High 7.1
    CVE-2026-97333

    QAPI stack-based buffer overflow

    QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.

    Commvault Commvault Cloud
  • High 7.1
    CVE-2026-77095

    CvFWD Null Pointer Dereference

    CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.

    Commvault Commvault Cloud
  • Critical 9.3
    CVE-2026-77099

    CVFS Command Execution

    CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.

    Commvault Commvault Cloud Grid(HSX) CVFS
  • High 7.7
    CVE-2026-77096

    CVFS Missing Authentication

    CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.

    Commvault Commvault Cloud Grid(HSX) CVFS
  • High 7.1
    CVE-2026-77094

    CvFWD Out-of-Bounds Write

    CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, …

    Commvault Commvault Cloud
  • High 7.1
    CVE-2026-77093

    CvFWD Denial of Service

    CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-77090

    CVFS Information Disclosure

    CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.

    Commvault Commvault Cloud Grid(HSX) CVFS
  • High 7.1
    CVE-2026-18228

    Hyperscale Path Traversal

    HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.

    Commvault Commvault Cloud
  • High 7.7
    CVE-2026-77106

    Cvlaunchd Code Execution

    Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients …

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-77101

    CommServe Stack-based Buffer Overflow

    CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-77103

    CommServe Information Disclosure

    CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

    Commvault Commvault Cloud
  • High 8.3
    CVE-2026-77104

    CommServe Path Traversal

    CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-77102

    CommServe Denial of Service

    CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-77105

    CommServe Privilege Escalation

    CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server.

    Commvault Commvault Cloud
  • High 7.3
    CVE-2026-77092

    Content Extractor Privilege Escalation

    Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.

    Commvault Commvault Cloud
  • Critical 9.3
    CVE-2026-77089

    Command Center API Authentication Bypass

    Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.

    Commvault Commvault Cloud
  • High 8.8
    CVE-2026-77097

    Private Metrics Server Denial of Service

    Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

    Commvault Commvault Cloud
  • High 8.8
    CVE-2026-77098

    Private Metrics Server SQL Injection

    Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

    Commvault Commvault Cloud
  • High 8.5
    CVE-2026-77091

    DataCube Security Feature Bypass

    DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.

    Commvault Commvault Cloud
  • Critical 9.2
    CVE-2026-13738

    Improper Authorization Validation

    CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, …

    Commvault Commvault Cloud
  • High 8.8
    CVE-2026-13739

    Server-Side Request Forgery (SSRF)

    A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.

    Commvault Commvault Cloud
  • Critical 9.2
    CVE-2026-13737

    Command Restriction Bypass

    CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clie…

    Commvault Commvault Cloud
  • Low 1.8
    CVE-2025-12776

    Stored Cross-Site Scripting

    The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting (XSS) attack. Proper management of this functionality helps ensure a secure an…

    Commvault WebConsole
  • Medium 6.9
    CVE-2025-57791 Public exploit EPSS 39%

    Argument Injection Vulnerability in CommServe

    A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. Successful exploitation results in a valid user session for a low priv…

    Commvault CommCell
  • High 8.7
    CVE-2025-57790 Public exploit EPSS 44%

    Path Traversal Vulnerability

    A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. The vulnerability may lead to remote code execution.

    Commvault CommCell
  • Medium 5.3
    CVE-2025-57789

    Vulnerability in Initial Administrator Login Process

    During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.

    Commvault CommCell
  • Medium 6.9
    CVE-2025-57788 Public exploit

    Unauthorized API Access Risk

    A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.

    Commvault CommCell
  • High 8.5
    CVE-2024-13976

    Commvault 11.20.0 - 11.36.0 Windows Maintenance Installer DLL Injection

    A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates, an attacker with local access may exploit uncontrolled search path or DLL loading behavior to execut…

    Commvault Commvault for Windows Windows
  • High 8.5
    CVE-2024-13975

    Commvault 11.20.0 - 11.36.0 Windows Access Nodes Compromise via Local File Server Agent Abuse

    A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations, a local attacker who owns a client system with the file server agent installed can compromise any …

    Commvault Commvault
  • Medium 6.9
    CVE-2025-34136

    Commvault CommServe Web Server Unauthenticated SQL Injection

    An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommSer…

    Commvault Commvault
  • High 8.8
    CVE-2025-3928 Exploited

    Commvault Web Server unspecified vulnerability

    Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.4…

    Commvault Web Server
    KEV Apr 28, 2025
  • Critical 9.3
    CVE-2025-34028 Exploited Public exploit EPSS 98%

    Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal

    The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Executi…

    Commvault Command Center Innovation Release
    KEV May 2, 2025
  • High 8.8
    CVE-2021-34997

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11…

    Commvault CommCell
  • High 8.8
    CVE-2021-34996 EPSS 82%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11…

    Commvault CommCell
  • High 8.8
    CVE-2021-34995 EPSS 69%

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11…

    Commvault CommCell
  • High 8.8
    CVE-2021-34994

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11…

    Commvault CommCell
  • Critical 9.8
    CVE-2021-34993

    This vulnerability allows remote attackers to bypass authentication on affected installations of Commvault CommCell 11.…

    Commvault CommCell
  • Unscored —
    CVE-2017-3195 Public exploit EPSS 21%

    Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stac…

    Commvault Service Pack 6