CVE Program partner

Commvault

Commvault Systems Inc.

API
CVEs, 365 days2525 all time, 0 rejected
Quality68%median 99%
CVSS by the CNA100%share of records
CWE4%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationCommvault Systems Inc.
RoleCNA
TypeVendor, Hosted Service
Reports tomitre
ScopeVulnerabilities in Commvault SaaS and software products only.
Advisorieshttps://documentation.commvault.com/securityadvisories

Latest CVEs · RSS

  • CVE-2026-97334 2026-10-13 · CVSS 8.7
    The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved mainte
  • CVE-2026-97333 2026-10-13 · CVSS 7.1
    QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web
  • CVE-2026-77100 2026-10-13 · CVSS 8.7
    MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Comm
  • CVE-2026-77099 2026-10-13 · CVSS 9.3
    CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
  • CVE-2026-77096 2026-10-13 · CVSS 7.7
    CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
  • CVE-2026-77095 2026-10-13 · CVSS 7.1
    CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault ins
  • CVE-2026-77094 2026-10-13 · CVSS 7.1
    CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade t
  • CVE-2026-77093 2026-10-13 · CVSS 7.1
    CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installati
  • CVE-2026-77090 2026-10-13 · CVSS 8.7
    CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance relea
  • CVE-2026-18228 2026-10-13 · CVSS 7.1
    HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault inst
  • CVE-2026-77106 2026-09-08 · CVSS 7.7
    Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update
  • CVE-2026-77105 2026-09-08 · CVSS 8.7
    CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Upd
  • CVE-2026-77104 2026-09-08 · CVSS 8.3
    CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.
  • CVE-2026-77103 2026-09-08 · CVSS 8.7
    CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance
  • CVE-2026-77102 2026-09-08 · CVSS 8.7
    CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommSe
  • CVE-2026-77101 2026-09-08 · CVSS 8.7
    CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommS
  • CVE-2026-77098 2026-09-08 · CVSS 8.8
    Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Pr
  • CVE-2026-77097 2026-09-08 · CVSS 8.8
    Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade
  • CVE-2026-77092 2026-09-08 · CVSS 7.3
    Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release
  • CVE-2026-77091 2026-09-08 · CVSS 8.5
    DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Ext
  • CVE-2026-77089 2026-09-08 · CVSS 9.3
    Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update C
  • CVE-2026-13738 2026-08-11 · CVSS 9.2
    CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maint
  • CVE-2026-13737 2026-08-11 · CVSS 9.2
    CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Up
  • CVE-2026-13739 2026-08-11 · CVSS 8.8
    A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target UR
  • CVE-2025-12776 2026-01-07 · CVSS 1.8
    The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible

All CVE Program partners