CVE-2026-77096
HighCVSS 7.7Summary
A vulnerability in CVFS (part of Commvault) involves a missing authentication condition affecting command execution. Customers are advised to upgrade to the resolved maintenance release.
Risk Assessment
Missing authentication may allow an attacker to execute commands without authorization, potentially leading to unauthorized access to systems and data.
Recommendation
Update CVFS to the patched release.
Other vulnerabilities in Commvault
See all- CVE-2026-97334High
A vulnerability in the network messaging layer of Commvault involves improper handling of highly compressed data affecting service availability. Customers are advised to upgrade to the resolved maintenance release.
- CVE-2026-97333High
A vulnerability in QAPI (part of Commvault) involves a stack-based buffer overflow affecting service availability. Customers are advised to upgrade to the resolved maintenance release.
- CVE-2026-77100High
A vulnerability in MediaAgent (part of Commvault) involves a heap-based buffer overflow affecting service availability. Customers are advised to upgrade to the resolved maintenance release.
- CVE-2026-77106High
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers should upgrade to the resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
Original NVD description (English source)
CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS