Commvault Cloud vulnerabilities

23 known vulnerabilities in Commvault Cloud from Commvault. 23 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  Commvault Cloud: Improper Handling of Highly Compressed Data (Data Amplification)

  CVE-2026-97334Oct 13, 2026Commvault

  The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Ce

• 7.1 High severity

  Commvault Cloud: Stack-based Buffer Overflow

  CVE-2026-97333Oct 13, 2026Commvault

  QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.

• 8.7 High severity

  Commvault Cloud: Heap-based Buffer Overflow

  CVE-2026-77100Oct 13, 2026Commvault

  MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.

• 7.7 High severity

  Commvault Cloud: Missing Authentication for Critical Functionality

  CVE-2026-77096Oct 13, 2026Commvault

  CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.

• 7.1 High severity

  Commvault Cloud: NULL Pointer Dereference

  CVE-2026-77095Oct 13, 2026Commvault

  CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.

• 7.1 High severity

  Commvault Cloud: Out-of-bounds Write

  CVE-2026-77094Oct 13, 2026Commvault

  CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, C

• 7.1 High severity

  Commvault Cloud: Integer Overflow or Wraparound

  CVE-2026-77093Oct 13, 2026Commvault

  CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale

• 8.7 High severity

  Commvault Cloud: Improper Restriction of XML External Entity Reference

  CVE-2026-77090Oct 13, 2026Commvault

  CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.

• 7.1 High severity

  Commvault Cloud: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-18228Oct 13, 2026Commvault

  HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.

• 8.8 High severity

  Commvault Cloud: Missing Authorization

  CVE-2026-77106Sep 8, 2026Commvault

  Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients a

• 8.8 High severity

  Commvault Cloud: Improper Verification of Cryptographic Signature

  CVE-2026-77105Sep 8, 2026Commvault

  CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server.

• 7.5 High severity

  Commvault Cloud: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-77104Sep 8, 2026Commvault

  CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

• 7.5 High severity

  Commvault Cloud: Authentication Bypass Using an Alternate Path or Channel

  CVE-2026-77103Sep 8, 2026Commvault

  CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

• 7.5 High severity

  Commvault Cloud: Heap-based Buffer Overflow

  CVE-2026-77102Sep 8, 2026Commvault

  CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.

• 7.5 High severity

  Commvault Cloud: Stack-based Buffer Overflow

  CVE-2026-77101Sep 8, 2026Commvault

  CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.

• 9.8 Critical severity

  Commvault Cloud: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-77098Sep 8, 2026Commvault

  Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

• 8.2 High severity

  Commvault Cloud: Missing Authentication for Critical Functionality

  CVE-2026-77097Sep 8, 2026Commvault

  Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

• 9.8 Critical severity

  Commvault Cloud: Deserialization of Untrusted Data

  CVE-2026-77092Sep 8, 2026Commvault

  Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.

• 7.8 High severity

  Commvault Cloud: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-77091Sep 8, 2026Commvault

  DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.

• 9.8 Critical severity

  Commvault Cloud: Authentication Bypass by Spoofing

  CVE-2026-77089Sep 8, 2026Commvault

  Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.

• 9.8 Critical severity

  Commvault Cloud: Server-Side Request Forgery

  CVE-2026-13739Aug 11, 2026Commvault

  A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.

• 9.8 Critical severity

  Commvault Cloud: Incorrect Authorization

  CVE-2026-13738Aug 11, 2026Commvault

  CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, M

• 9.8 Critical severity

  Commvault Cloud: Incorrect Authorization

  CVE-2026-13737Aug 11, 2026Commvault

  CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clien