Skip to content
OpenAdvisories

Product · Commvault

Commvault Cloud

24 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

20 results · Clear filters · Feed

  • High 8.7
    CVE-2026-77100

    MediaAgent Denial of Service

    MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-97334

    Network messaging layer decompression resource exhaustion

    The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command C…

    Commvault Commvault Cloud
  • High 7.1
    CVE-2026-97333

    QAPI stack-based buffer overflow

    QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.

    Commvault Commvault Cloud
  • High 7.1
    CVE-2026-77095

    CvFWD Null Pointer Dereference

    CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.

    Commvault Commvault Cloud
  • High 7.7
    CVE-2026-77096

    CVFS Missing Authentication

    CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.

    Commvault Commvault Cloud Grid(HSX) CVFS
  • High 7.1
    CVE-2026-77094

    CvFWD Out-of-Bounds Write

    CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, …

    Commvault Commvault Cloud
  • High 7.1
    CVE-2026-77093

    CvFWD Denial of Service

    CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-77090

    CVFS Information Disclosure

    CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.

    Commvault Commvault Cloud Grid(HSX) CVFS
  • High 7.1
    CVE-2026-18228

    Hyperscale Path Traversal

    HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.

    Commvault Commvault Cloud
  • High 7.7
    CVE-2026-77106

    Cvlaunchd Code Execution

    Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients …

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-77101

    CommServe Stack-based Buffer Overflow

    CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-77103

    CommServe Information Disclosure

    CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

    Commvault Commvault Cloud
  • High 8.3
    CVE-2026-77104

    CommServe Path Traversal

    CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-77102

    CommServe Denial of Service

    CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.

    Commvault Commvault Cloud
  • High 8.7
    CVE-2026-77105

    CommServe Privilege Escalation

    CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server.

    Commvault Commvault Cloud
  • High 7.3
    CVE-2026-77092

    Content Extractor Privilege Escalation

    Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.

    Commvault Commvault Cloud
  • High 8.8
    CVE-2026-77097

    Private Metrics Server Denial of Service

    Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

    Commvault Commvault Cloud
  • High 8.8
    CVE-2026-77098

    Private Metrics Server SQL Injection

    Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

    Commvault Commvault Cloud
  • High 8.5
    CVE-2026-77091

    DataCube Security Feature Bypass

    DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.

    Commvault Commvault Cloud
  • High 8.8
    CVE-2026-13739

    Server-Side Request Forgery (SSRF)

    A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.

    Commvault Commvault Cloud