{"id":"CVE-2026-77091","title":"DataCube contained a path traversal issue affecting security feature enforcement","summary":"DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-22"],"vendor":"commvault","product":"commvault","affected":["commvault >= 11.36.0, < 11.36.123","commvault >= 11.40.0, < 11.40.72","commvault >= 11.44.0, < 11.44.20","commvault >= 11.46.0, < 11.46.20"],"patched":["commvault 11.46.20"],"published":"2026-09-08","updated":"2026-09-11","sourceUpdated":"2026-09-11T14:24:13.410","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77091","references":[{"url":"https://documentation.commvault.com/securityadvisories/CV_2026_07_3.html","label":"050066fd-a2f9-4f32-ab5d-4c53f48bc333"}],"tags":["nvd","cve.org"],"epss":0.00133,"epssPercentile":0.03237,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-08T13:33:48.703147Z"},"scores":{"nvd":7.8,"cna":8.5},"ingestedAt":"2026-09-08T15:33:26.984Z","slug":"CVE-2026-77091","body":"## Overview\n\nDataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.\n\n## Affected\n\n- `commvault >= 11.36.0, < 11.36.123`\n- `commvault >= 11.40.0, < 11.40.72`\n- `commvault >= 11.44.0, < 11.44.20`\n- `commvault >= 11.46.0, < 11.46.20`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `commvault 11.46.20`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201917,"id":"CVE-2026-77091","ts":1789399986759,"field":"cvss","old":"8.5","new":"7.8"},{"seq":200647,"id":"CVE-2026-77091","ts":1789397562665,"field":"cvss","old":"7.8","new":"8.5"},{"seq":199354,"id":"CVE-2026-77091","ts":1789395472316,"field":"cvss","old":"8.5","new":"7.8"},{"seq":198599,"id":"CVE-2026-77091","ts":1789392166700,"field":"cvss","old":"7.8","new":"8.5"},{"seq":198554,"id":"CVE-2026-77091","ts":1789392092742,"field":"cvss","old":"8.5","new":"7.8"},{"seq":196345,"id":"CVE-2026-77091","ts":1789383734860,"field":"cvss","old":"7.8","new":"8.5"},{"seq":195274,"id":"CVE-2026-77091","ts":1789380554413,"field":"cvss","old":"8.5","new":"7.8"},{"seq":194061,"id":"CVE-2026-77091","ts":1789378659076,"field":"cvss","old":"7.8","new":"8.5"},{"seq":192848,"id":"CVE-2026-77091","ts":1789376488296,"field":"cvss","old":"8.5","new":"7.8"},{"seq":191635,"id":"CVE-2026-77091","ts":1789373581365,"field":"cvss","old":"7.8","new":"8.5"},{"seq":190420,"id":"CVE-2026-77091","ts":1789369427965,"field":"cvss","old":"8.5","new":"7.8"},{"seq":189207,"id":"CVE-2026-77091","ts":1789368355319,"field":"cvss","old":"7.8","new":"8.5"},{"seq":187990,"id":"CVE-2026-77091","ts":1789365208286,"field":"cvss","old":"8.5","new":"7.8"},{"seq":186777,"id":"CVE-2026-77091","ts":1789363436748,"field":"cvss","old":"7.8","new":"8.5"},{"seq":185563,"id":"CVE-2026-77091","ts":1789361192422,"field":"cvss","old":"8.5","new":"7.8"},{"seq":184350,"id":"CVE-2026-77091","ts":1789358300119,"field":"cvss","old":"7.8","new":"8.5"},{"seq":182601,"id":"CVE-2026-77091","ts":1789354298284,"field":"cvss","old":"8.5","new":"7.8"},{"seq":181394,"id":"CVE-2026-77091","ts":1789353262576,"field":"cvss","old":"7.8","new":"8.5"},{"seq":180187,"id":"CVE-2026-77091","ts":1789350253096,"field":"cvss","old":"8.5","new":"7.8"},{"seq":178980,"id":"CVE-2026-77091","ts":1789348249980,"field":"cvss","old":"7.8","new":"8.5"},{"seq":177773,"id":"CVE-2026-77091","ts":1789346351444,"field":"cvss","old":"8.5","new":"7.8"},{"seq":176566,"id":"CVE-2026-77091","ts":1789343154119,"field":"cvss","old":"7.8","new":"8.5"},{"seq":174683,"id":"CVE-2026-77091","ts":1789334847767,"field":"cvss","old":"8.5","new":"7.8"},{"seq":173478,"id":"CVE-2026-77091","ts":1789333636537,"field":"cvss","old":"7.8","new":"8.5"},{"seq":172292,"id":"CVE-2026-77091","ts":1789331073832,"field":"cvss","old":"8.5","new":"7.8"},{"seq":171106,"id":"CVE-2026-77091","ts":1789328735656,"field":"cvss","old":"7.8","new":"8.5"},{"seq":169901,"id":"CVE-2026-77091","ts":1789327137626,"field":"cvss","old":"8.5","new":"7.8"},{"seq":168696,"id":"CVE-2026-77091","ts":1789323793756,"field":"cvss","old":"7.8","new":"8.5"},{"seq":167491,"id":"CVE-2026-77091","ts":1789319663870,"field":"cvss","old":"8.5","new":"7.8"},{"seq":166286,"id":"CVE-2026-77091","ts":1789318721162,"field":"cvss","old":"7.8","new":"8.5"},{"seq":165081,"id":"CVE-2026-77091","ts":1789315769458,"field":"cvss","old":"8.5","new":"7.8"},{"seq":163876,"id":"CVE-2026-77091","ts":1789313590162,"field":"cvss","old":"7.8","new":"8.5"},{"seq":162671,"id":"CVE-2026-77091","ts":1789311882202,"field":"cvss","old":"8.5","new":"7.8"},{"seq":161466,"id":"CVE-2026-77091","ts":1789308680083,"field":"cvss","old":"7.8","new":"8.5"},{"seq":159579,"id":"CVE-2026-77091","ts":1789300451889,"field":"cvss","old":"8.5","new":"7.8"},{"seq":156568,"id":"CVE-2026-77091","ts":1789294723428,"field":"cvss","old":"7.8","new":"8.5"},{"seq":155363,"id":"CVE-2026-77091","ts":1789292913280,"field":"cvss","old":"8.5","new":"7.8"},{"seq":154158,"id":"CVE-2026-77091","ts":1789289749464,"field":"cvss","old":"7.8","new":"8.5"},{"seq":152808,"id":"CVE-2026-77091","ts":1789281652537,"field":"cvss","old":"8.5","new":"7.8"},{"seq":152448,"id":"CVE-2026-77091","ts":1789281224481,"field":"cvss","old":"7.8","new":"8.5"},{"seq":151409,"id":"CVE-2026-77091","ts":1789277607462,"field":"cvss","old":"8.5","new":"7.8"},{"seq":150370,"id":"CVE-2026-77091","ts":1789276209890,"field":"cvss","old":"7.8","new":"8.5"},{"seq":149337,"id":"CVE-2026-77091","ts":1789273803749,"field":"cvss","old":"8.5","new":"7.8"},{"seq":148304,"id":"CVE-2026-77091","ts":1789271294390,"field":"cvss","old":"7.8","new":"8.5"},{"seq":146336,"id":"CVE-2026-77091","ts":1789269357662,"field":"cvss","old":"8.5","new":"7.8"},{"seq":145141,"id":"CVE-2026-77091","ts":1789266305259,"field":"cvss","old":"7.8","new":"8.5"},{"seq":144045,"id":"CVE-2026-77091","ts":1789262586134,"field":"cvss","old":"8.5","new":"7.8"},{"seq":142949,"id":"CVE-2026-77091","ts":1789261486048,"field":"cvss","old":"7.8","new":"8.5"},{"seq":141780,"id":"CVE-2026-77091","ts":1789258811172,"field":"cvss","old":"8.5","new":"7.8"},{"seq":140621,"id":"CVE-2026-77091","ts":1789256700632,"field":"cvss","old":"7.8","new":"8.5"}]}