CVEvulnerability

CVE-2026-13737

9.2 CRITICAL Published 2026-08-11 Modified 2026-10-23 Official page ↗
Status
Analyzed
Published
2026-08-11
Last modified
2026-10-23
Assigner
050066fd-a2f9-4f32-ab5d-4c53f48bc333
CVSS 4.0 (050066fd-a2f9-4f32-ab5d-4c53f48bc333)
9.2 CRITICAL — CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-863

Description

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

Affected configurations

• commvault commvault (>= 11.36.0 < 11.36.114) • commvault commvault (>= 11.40.0 < 11.40.63) • commvault commvault (>= 11.44.0 < 11.44.11) • commvault commvault (>= 11.46.0 < 11.46.10)

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References