Vendor
Commvault
40 known vulnerabilities.
Products
28 results · Clear filters · Feed
-
High 8.7
MediaAgent Denial of Service
MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.
-
High 8.7
Network messaging layer decompression resource exhaustion
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command C…
-
High 7.1
QAPI stack-based buffer overflow
QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.
-
High 7.1
CvFWD Null Pointer Dereference
CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
-
High 7.7
CVFS Missing Authentication
CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
-
High 7.1
CvFWD Out-of-Bounds Write
CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, …
-
High 7.1
CvFWD Denial of Service
CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale
-
High 8.7
CVFS Information Disclosure
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.
-
High 7.1
Hyperscale Path Traversal
HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.
-
High 7.7
Cvlaunchd Code Execution
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients …
-
High 8.7
CommServe Stack-based Buffer Overflow
CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.
-
High 8.7
CommServe Information Disclosure
CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.
-
High 8.3
CommServe Path Traversal
CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.
-
High 8.7
CommServe Denial of Service
CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.
-
High 8.7
CommServe Privilege Escalation
CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server.
-
High 7.3
Content Extractor Privilege Escalation
Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.
-
High 8.8
Private Metrics Server Denial of Service
Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.
-
High 8.8
Private Metrics Server SQL Injection
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.
-
High 8.5
DataCube Security Feature Bypass
DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.
-
High 8.8
Server-Side Request Forgery (SSRF)
A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.
-
High 8.7
Path Traversal Vulnerability
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. The vulnerability may lead to remote code execution.
-
High 8.5
Commvault 11.20.0 - 11.36.0 Windows Maintenance Installer DLL Injection
A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates, an attacker with local access may exploit uncontrolled search path or DLL loading behavior to execut…
-
High 8.5
Commvault 11.20.0 - 11.36.0 Windows Access Nodes Compromise via Local File Server Agent Abuse
A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations, a local attacker who owns a client system with the file server agent installed can compromise any …
-
High 8.8CVE-2025-3928 Exploited
Commvault Web Server unspecified vulnerability
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.4…
KEV Apr 28, 2025 -
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11…
-
High 8.8CVE-2021-34996 EPSS 82%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11…
-
High 8.8CVE-2021-34995 EPSS 69%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11…
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11…