Commvault
Vulnerability activity for Commvault: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 11
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 25
- Critical (CVSS 9+)
- 7
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 26
- Critical (CVSS 9+)
- 7
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 9.3CriticalApr 22, 2025Commvault Command Center Path traversal / file handlingCVE-2025-34028Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.Added to KEV May 2, 2025 · 9 days after publicationExploited98% likelyExploit codeNucleiDetection
- 8.8HighApr 25, 2025Commvault Web Server Code / command injectionCVE-2025-3928Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.Added to KEV Apr 28, 2025 · 2 days after publicationExploited2.5% likely
Recent
- –UnscoredOct 13, 2026CommvaultADV-cccs-7d694cedbf99Serial number: AV26-1033 Date: October 13, 2026 As of October 13, 2026, Commvault is affected by vulnerabilities in the following products: Commvault Cloud 11.36.0 Prior to 11.36.127 11.40.0 Prior to 11.40.78 11.44.0 Prior to 11.44.25 11.46.0 Prior to 11.46.30 11.46.0 Prior to 11.46.40 Grid (HSX) CVFS 5.0.1.0 Prior to 5.0.14.5 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Commvault Cloud Security Adv
- 8.7HighOct 13, 2026Commvault CloudCVE-2026-97334The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.
- 7.1HighOct 13, 2026Commvault Cloud Memory corruptionCVE-2026-97333QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.
- 8.7HighOct 13, 2026Commvault Cloud Memory corruptionCVE-2026-77100MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.
- 9.3CriticalOct 13, 2026Commvault Cloud Code / command injectionCVE-2026-77099CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
- 7.7HighOct 13, 2026Commvault Cloud Auth bypass / access controlCVE-2026-77096CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
- 7.1HighOct 13, 2026Commvault Cloud Memory corruptionCVE-2026-77095CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
- 7.1HighOct 13, 2026Commvault Cloud Memory corruptionCVE-2026-77094CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
- 7.1HighOct 13, 2026Commvault Cloud Memory corruptionCVE-2026-77093CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale
- 8.7HighOct 13, 2026Commvault CloudCVE-2026-77090CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.
- 7.1HighOct 13, 2026Commvault Cloud Path traversal / file handlingCVE-2026-18228HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.
- 8.8HighSep 8, 2026commvault Auth bypass / access controlCVE-2026-77106Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
- 8.8HighSep 8, 2026commvault Crypto / certificateCVE-2026-77105CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server.
- 7.5HighSep 8, 2026commvault Path traversal / file handlingCVE-2026-77104CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.
- 7.5HighSep 8, 2026commvault Auth bypass / access controlCVE-2026-77103CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.
- 7.5HighSep 8, 2026commvault Memory corruptionCVE-2026-77102CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.
- 7.5HighSep 8, 2026commvault Memory corruptionCVE-2026-77101CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.
- 9.8CriticalSep 8, 2026commvault SQL injectionCVE-2026-77098Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.
- 8.2HighSep 8, 2026commvault Auth bypass / access controlCVE-2026-77097Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.
- 9.8CriticalSep 8, 2026commvault DeserializationCVE-2026-77092Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.
- 7.8HighSep 8, 2026commvault Path traversal / file handlingCVE-2026-77091DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.
- 9.8CriticalSep 8, 2026commvault Auth bypass / access controlCVE-2026-77089Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.
- 9.8CriticalAug 11, 2026commvault SSRFCVE-2026-13739A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.
- 9.8CriticalAug 11, 2026commvault Auth bypass / access controlCVE-2026-13738CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
- 9.8CriticalAug 11, 2026commvault Auth bypass / access controlCVE-2026-13737CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
- 5.4MediumJan 7, 2026commvault XSSCVE-2025-12776The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site Scripting (XSS) attack. Proper management of this functionality helps ensure a secure and seamless user experience. Although the user input is not validated in the report creation, these scripts are not executed when the report is run by end users. The script is executed when the report is modified through the report builder b
- 9.3CriticalApr 22, 2025Commvault Command Center Path traversal / file handlingCVE-2025-34028Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.Exploited98% likelyExploit codeNucleiDetection
- 8.8HighApr 25, 2025Commvault Web Server Code / command injectionCVE-2025-3928Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.Exploited2.5% likely
Top products
- commvault15 CVEs in the last year, 6 critical
- Commvault Cloud10 CVEs in the last year, 1 critical
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- CCCS (Canada) · Oct 13, 2026Commvault security advisory (AV26-1033)ADV-cccs-7d694cedbf99
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.