CVE-2026-13737
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Customers should upgrade to the resolved maintenance release.
Risk Assessment
Allowlist bypass may allow unauthorized command execution, potentially leading to system security compromise.
Recommendation
Update all Commvault installations, including CommServe, Webserver, Command Center, Media Agents, Clients, and HyperScale X, to the patched version.
Other vulnerabilities in CommServe
See all- CVE-2026-13738Critical
CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Customers should upgrade to the resolved maintenance release.
- CVE-2026-77105High
CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers should upgrade to the resolved maintenance release. Update CommServe and Web Server.
- CVE-2026-77104High
CommServe contained a path traversal issue affecting information disclosure. Software customers should upgrade to the resolved maintenance release. Update CommServe.
- CVE-2026-77103High
CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers should upgrade to the resolved maintenance release. Update CommServe.
- CVE-2026-77102High
CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers should upgrade to the resolved maintenance release. Update CommServe.
- CVE-2026-77101High
CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers should upgrade to the resolved maintenance release. Update CommServe.
Original NVD description (English source)
CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS