CVE-2026-97333
HighCVSS 7.1Summary
A vulnerability in QAPI (part of Commvault) involves a stack-based buffer overflow affecting service availability. Customers are advised to upgrade to the resolved maintenance release.
Risk Assessment
Buffer overflow could lead to service crashes, potentially disrupting CommServe, Web Server, Command Center, and Index Server, affecting backup management capabilities.
Recommendation
Update CommServe, Web Server, Command Center, and Index Server to the patched release.
Other vulnerabilities in Commvault
See all- CVE-2026-97334High
A vulnerability in the network messaging layer of Commvault involves improper handling of highly compressed data affecting service availability. Customers are advised to upgrade to the resolved maintenance release.
- CVE-2026-77100High
A vulnerability in MediaAgent (part of Commvault) involves a heap-based buffer overflow affecting service availability. Customers are advised to upgrade to the resolved maintenance release.
- CVE-2026-77096High
A vulnerability in CVFS (part of Commvault) involves a missing authentication condition affecting command execution. Customers are advised to upgrade to the resolved maintenance release.
- CVE-2026-77106High
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers should upgrade to the resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
Original NVD description (English source)
QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS