Commvault vulnerabilities
We track 28 vulnerabilities in Commvault products across 7 products. 28 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on October 13, 2026.
Latest Commvault vulnerabilities
- 8.7 High severity
Commvault Cloud: Improper Handling of Highly Compressed Data (Data Amplification)
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Ce
- 7.1 High severity
Commvault Cloud: Stack-based Buffer Overflow
QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.
- 8.7 High severity
Commvault Cloud: Heap-based Buffer Overflow
MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.
- 7.7 High severity
Commvault Cloud: Missing Authentication for Critical Functionality
CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
- 7.1 High severity
Commvault Cloud: NULL Pointer Dereference
CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
- 7.1 High severity
Commvault Cloud: Out-of-bounds Write
CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, C
- 7.1 High severity
Commvault Cloud: Integer Overflow or Wraparound
CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale
- 8.7 High severity
Commvault Cloud: Improper Restriction of XML External Entity Reference
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.
- 7.1 High severity
Commvault Cloud: Improper Limitation of a Pathname to a Restricted Directory
HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.
- 8.8 High severity
Commvault Cloud: Missing Authorization
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients a
- 8.8 High severity
Commvault Cloud: Improper Verification of Cryptographic Signature
CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server.
- 7.5 High severity
Commvault Cloud: Improper Limitation of a Pathname to a Restricted Directory
CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.
- 7.5 High severity
Commvault Cloud: Authentication Bypass Using an Alternate Path or Channel
CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.
- 7.5 High severity
Commvault Cloud: Heap-based Buffer Overflow
CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.
- 7.5 High severity
Commvault Cloud: Stack-based Buffer Overflow
CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.
- 9.8 Critical severity
Commvault Cloud: Improper Neutralization of Special Elements used in an SQL Command
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.
- 8.2 High severity
Commvault Cloud: Missing Authentication for Critical Functionality
Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.
- 9.8 Critical severity
Commvault Cloud: Deserialization of Untrusted Data
Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.
- 7.8 High severity
Commvault Cloud: Improper Limitation of a Pathname to a Restricted Directory
DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.
- 9.8 Critical severity
Commvault Cloud: Authentication Bypass by Spoofing
Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.
- 9.8 Critical severity
Commvault Cloud: Server-Side Request Forgery
A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.
- 9.8 Critical severity
Commvault Cloud: Incorrect Authorization
CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, M
- 9.8 Critical severity
Commvault Cloud: Incorrect Authorization
CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clien
- 8.8 High severity
CommCell: Absolute Path Traversal
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. The vulnerability may lead to remote code execution.
- 8.5 High severity
Commvault for Windows: Uncontrolled Search Path Element
A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates, an attacker with local access may exploit uncontrolled search path or DLL loading behavior to execute
- 8.5 High severity
Commvault: Improper Privilege Management
A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations, a local attacker who owns a client system with the file server agent installed can compromise any a
- 8.8 High severity
Commvault Web Server Unspecified Exploited
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46
- 10.0 Critical severity
Commvault Command Center Path Traversal Exploited
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Executio