{"id":"CVE-2026-77089","title":"Command Center API contained an authentication bypass issue affecting privilege management","summary":"Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-290"],"vendor":"commvault","product":"commvault","affected":["commvault >= 11.36.0, < 11.36.123","commvault >= 11.40.0, < 11.40.72","commvault >= 11.44.0, < 11.44.20","commvault >= 11.46.0, < 11.46.20"],"patched":["commvault 11.46.20"],"published":"2026-09-08","updated":"2026-09-11","sourceUpdated":"2026-09-11T14:25:43.913","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77089","references":[{"url":"https://documentation.commvault.com/securityadvisories/CV_2026_07_1.html","label":"050066fd-a2f9-4f32-ab5d-4c53f48bc333"}],"tags":["nvd","cve.org"],"epss":0.00329,"epssPercentile":0.26137,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-09T04:26:06.353164Z"},"scores":{"nvd":9.8,"cna":9.3},"ingestedAt":"2026-09-08T15:33:26.984Z","slug":"CVE-2026-77089","body":"## Overview\n\nCommand Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.\n\n## Affected\n\n- `commvault >= 11.36.0, < 11.36.123`\n- `commvault >= 11.40.0, < 11.40.72`\n- `commvault >= 11.44.0, < 11.44.20`\n- `commvault >= 11.46.0, < 11.46.20`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `commvault 11.46.20`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201916,"id":"CVE-2026-77089","ts":1789399986751,"field":"cvss","old":"9.3","new":"9.8"},{"seq":200646,"id":"CVE-2026-77089","ts":1789397562658,"field":"cvss","old":"9.8","new":"9.3"},{"seq":199353,"id":"CVE-2026-77089","ts":1789395472309,"field":"cvss","old":"9.3","new":"9.8"},{"seq":198598,"id":"CVE-2026-77089","ts":1789392166692,"field":"cvss","old":"9.8","new":"9.3"},{"seq":198553,"id":"CVE-2026-77089","ts":1789392092734,"field":"cvss","old":"9.3","new":"9.8"},{"seq":196344,"id":"CVE-2026-77089","ts":1789383734853,"field":"cvss","old":"9.8","new":"9.3"},{"seq":195273,"id":"CVE-2026-77089","ts":1789380554405,"field":"cvss","old":"9.3","new":"9.8"},{"seq":194060,"id":"CVE-2026-77089","ts":1789378659068,"field":"cvss","old":"9.8","new":"9.3"},{"seq":192847,"id":"CVE-2026-77089","ts":1789376488290,"field":"cvss","old":"9.3","new":"9.8"},{"seq":191634,"id":"CVE-2026-77089","ts":1789373581357,"field":"cvss","old":"9.8","new":"9.3"},{"seq":190419,"id":"CVE-2026-77089","ts":1789369427956,"field":"cvss","old":"9.3","new":"9.8"},{"seq":189206,"id":"CVE-2026-77089","ts":1789368355312,"field":"cvss","old":"9.8","new":"9.3"},{"seq":187989,"id":"CVE-2026-77089","ts":1789365208279,"field":"cvss","old":"9.3","new":"9.8"},{"seq":186776,"id":"CVE-2026-77089","ts":1789363436741,"field":"cvss","old":"9.8","new":"9.3"},{"seq":185562,"id":"CVE-2026-77089","ts":1789361192416,"field":"cvss","old":"9.3","new":"9.8"},{"seq":184349,"id":"CVE-2026-77089","ts":1789358300112,"field":"cvss","old":"9.8","new":"9.3"},{"seq":182600,"id":"CVE-2026-77089","ts":1789354298278,"field":"cvss","old":"9.3","new":"9.8"},{"seq":181393,"id":"CVE-2026-77089","ts":1789353262568,"field":"cvss","old":"9.8","new":"9.3"},{"seq":180186,"id":"CVE-2026-77089","ts":1789350253088,"field":"cvss","old":"9.3","new":"9.8"},{"seq":178979,"id":"CVE-2026-77089","ts":1789348249973,"field":"cvss","old":"9.8","new":"9.3"},{"seq":177772,"id":"CVE-2026-77089","ts":1789346351438,"field":"cvss","old":"9.3","new":"9.8"},{"seq":176565,"id":"CVE-2026-77089","ts":1789343154112,"field":"cvss","old":"9.8","new":"9.3"},{"seq":174682,"id":"CVE-2026-77089","ts":1789334847761,"field":"cvss","old":"9.3","new":"9.8"},{"seq":173477,"id":"CVE-2026-77089","ts":1789333636373,"field":"cvss","old":"9.8","new":"9.3"},{"seq":172291,"id":"CVE-2026-77089","ts":1789331073825,"field":"cvss","old":"9.3","new":"9.8"},{"seq":171105,"id":"CVE-2026-77089","ts":1789328735649,"field":"cvss","old":"9.8","new":"9.3"},{"seq":169900,"id":"CVE-2026-77089","ts":1789327137619,"field":"cvss","old":"9.3","new":"9.8"},{"seq":168695,"id":"CVE-2026-77089","ts":1789323793748,"field":"cvss","old":"9.8","new":"9.3"},{"seq":167490,"id":"CVE-2026-77089","ts":1789319663864,"field":"cvss","old":"9.3","new":"9.8"},{"seq":166285,"id":"CVE-2026-77089","ts":1789318721153,"field":"cvss","old":"9.8","new":"9.3"},{"seq":165080,"id":"CVE-2026-77089","ts":1789315769451,"field":"cvss","old":"9.3","new":"9.8"},{"seq":163875,"id":"CVE-2026-77089","ts":1789313590153,"field":"cvss","old":"9.8","new":"9.3"},{"seq":162670,"id":"CVE-2026-77089","ts":1789311882196,"field":"cvss","old":"9.3","new":"9.8"},{"seq":161465,"id":"CVE-2026-77089","ts":1789308680075,"field":"cvss","old":"9.8","new":"9.3"},{"seq":159578,"id":"CVE-2026-77089","ts":1789300451882,"field":"cvss","old":"9.3","new":"9.8"},{"seq":156567,"id":"CVE-2026-77089","ts":1789294723421,"field":"cvss","old":"9.8","new":"9.3"},{"seq":155362,"id":"CVE-2026-77089","ts":1789292913153,"field":"cvss","old":"9.3","new":"9.8"},{"seq":154157,"id":"CVE-2026-77089","ts":1789289749456,"field":"cvss","old":"9.8","new":"9.3"},{"seq":152807,"id":"CVE-2026-77089","ts":1789281652376,"field":"cvss","old":"9.3","new":"9.8"},{"seq":152447,"id":"CVE-2026-77089","ts":1789281224475,"field":"cvss","old":"9.8","new":"9.3"},{"seq":151408,"id":"CVE-2026-77089","ts":1789277607455,"field":"cvss","old":"9.3","new":"9.8"},{"seq":150369,"id":"CVE-2026-77089","ts":1789276209876,"field":"cvss","old":"9.8","new":"9.3"},{"seq":149336,"id":"CVE-2026-77089","ts":1789273803741,"field":"cvss","old":"9.3","new":"9.8"},{"seq":148303,"id":"CVE-2026-77089","ts":1789271294383,"field":"cvss","old":"9.8","new":"9.3"},{"seq":146335,"id":"CVE-2026-77089","ts":1789269357655,"field":"cvss","old":"9.3","new":"9.8"},{"seq":145140,"id":"CVE-2026-77089","ts":1789266305250,"field":"cvss","old":"9.8","new":"9.3"},{"seq":144044,"id":"CVE-2026-77089","ts":1789262586126,"field":"cvss","old":"9.3","new":"9.8"},{"seq":142948,"id":"CVE-2026-77089","ts":1789261486040,"field":"cvss","old":"9.8","new":"9.3"},{"seq":141779,"id":"CVE-2026-77089","ts":1789258811165,"field":"cvss","old":"9.3","new":"9.8"},{"seq":140620,"id":"CVE-2026-77089","ts":1789256700625,"field":"cvss","old":"9.8","new":"9.3"}]}