Skip to content
OpenAdvisories

Product · Commvault

Commvault Cloud

24 known vulnerabilities.

Commvault Cloud at a glance

Last 12 months
24
Critical · all time
4
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 10 20 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 3 vulnerabilities, 2 critical September 2026: 11 vulnerabilities, 1 critical Sep October 2026: 10 vulnerabilities, 1 critical November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 2026101
Sep 2026111
Aug 202632
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

24 results · Feed

  • High 8.7
    CVE-2026-77100

    MediaAgent Denial of Service

    MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-97334

    Network messaging layer decompression resource exhaustion

    The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command C…

    Commvault Commvault Cloud
  • High 7.1
    CVE-2026-97333

    QAPI stack-based buffer overflow

    QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.

    Commvault Commvault Cloud
  • High 7.1
    CVE-2026-77095

    CvFWD Null Pointer Dereference

    CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.

    Commvault Commvault Cloud
  • Critical 9.3
    CVE-2026-77099

    CVFS Command Execution

    CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.

    Commvault Commvault Cloud Grid(HSX) CVFS
  • High 7.7
    CVE-2026-77096

    CVFS Missing Authentication

    CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.

    Commvault Commvault Cloud Grid(HSX) CVFS
  • High 7.1
    CVE-2026-77094

    CvFWD Out-of-Bounds Write

    CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, …

    Commvault Commvault Cloud
  • High 7.1
    CVE-2026-77093

    CvFWD Denial of Service

    CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-77090

    CVFS Information Disclosure

    CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.

    Commvault Commvault Cloud Grid(HSX) CVFS
  • High 7.1
    CVE-2026-18228

    Hyperscale Path Traversal

    HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.

    Commvault Commvault Cloud
  • High 7.7
    CVE-2026-77106

    Cvlaunchd Code Execution

    Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients …

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-77101

    CommServe Stack-based Buffer Overflow

    CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-77103

    CommServe Information Disclosure

    CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

    Commvault Commvault Cloud
  • High 8.3
    CVE-2026-77104

    CommServe Path Traversal

    CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-77102

    CommServe Denial of Service

    CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-77105

    CommServe Privilege Escalation

    CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server.

    Commvault Commvault Cloud
  • High 7.3
    CVE-2026-77092

    Content Extractor Privilege Escalation

    Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.

    Commvault Commvault Cloud
  • Critical 9.3
    CVE-2026-77089

    Command Center API Authentication Bypass

    Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.

    Commvault Commvault Cloud
  • High 8.8
    CVE-2026-77097

    Private Metrics Server Denial of Service

    Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

    Commvault Commvault Cloud
  • High 8.8
    CVE-2026-77098

    Private Metrics Server SQL Injection

    Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

    Commvault Commvault Cloud
  • High 8.5
    CVE-2026-77091

    DataCube Security Feature Bypass

    DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.

    Commvault Commvault Cloud
  • Critical 9.2
    CVE-2026-13738

    Improper Authorization Validation

    CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, …

    Commvault Commvault Cloud
  • High 8.8
    CVE-2026-13739

    Server-Side Request Forgery (SSRF)

    A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.

    Commvault Commvault Cloud
  • Critical 9.2
    CVE-2026-13737

    Command Restriction Bypass

    CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clie…

    Commvault Commvault Cloud