{"id":"CVE-2026-77092","title":"Content Extractor contained a deserialization of untrusted data issue affecting privilege management","summary":"Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-502"],"vendor":"commvault","product":"commvault","affected":["commvault >= 11.36.0, < 11.36.123","commvault >= 11.40.0, < 11.40.72","commvault >= 11.44.0, < 11.44.20","commvault >= 11.46.0, < 11.46.20"],"patched":["commvault 11.46.20"],"published":"2026-09-08","updated":"2026-09-11","sourceUpdated":"2026-09-11T14:22:39.357","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77092","references":[{"url":"https://documentation.commvault.com/securityadvisories/CV_2026_07_6.html","label":"050066fd-a2f9-4f32-ab5d-4c53f48bc333"}],"tags":["nvd","cve.org","score-dispute"],"epss":0.00185,"epssPercentile":0.08371,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-08T13:34:22.105440Z"},"scores":{"nvd":9.8,"cna":7.3},"ingestedAt":"2026-09-08T15:33:26.984Z","slug":"CVE-2026-77092","body":"## Overview\n\nContent Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.\n\n## Affected\n\n- `commvault >= 11.36.0, < 11.36.123`\n- `commvault >= 11.40.0, < 11.40.72`\n- `commvault >= 11.44.0, < 11.44.20`\n- `commvault >= 11.46.0, < 11.46.20`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `commvault 11.46.20`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201919,"id":"CVE-2026-77092","ts":1789399986767,"field":"cvss","old":"7.3","new":"9.8"},{"seq":201918,"id":"CVE-2026-77092","ts":1789399986767,"field":"severity","old":"high","new":"critical"},{"seq":200649,"id":"CVE-2026-77092","ts":1789397562672,"field":"cvss","old":"9.8","new":"7.3"},{"seq":200648,"id":"CVE-2026-77092","ts":1789397562672,"field":"severity","old":"critical","new":"high"},{"seq":199356,"id":"CVE-2026-77092","ts":1789395472322,"field":"cvss","old":"7.3","new":"9.8"},{"seq":199355,"id":"CVE-2026-77092","ts":1789395472322,"field":"severity","old":"high","new":"critical"},{"seq":198601,"id":"CVE-2026-77092","ts":1789392166708,"field":"cvss","old":"9.8","new":"7.3"},{"seq":198600,"id":"CVE-2026-77092","ts":1789392166708,"field":"severity","old":"critical","new":"high"},{"seq":198556,"id":"CVE-2026-77092","ts":1789392092749,"field":"cvss","old":"7.3","new":"9.8"},{"seq":198555,"id":"CVE-2026-77092","ts":1789392092749,"field":"severity","old":"high","new":"critical"},{"seq":196347,"id":"CVE-2026-77092","ts":1789383734867,"field":"cvss","old":"9.8","new":"7.3"},{"seq":196346,"id":"CVE-2026-77092","ts":1789383734867,"field":"severity","old":"critical","new":"high"},{"seq":195276,"id":"CVE-2026-77092","ts":1789380554421,"field":"cvss","old":"7.3","new":"9.8"},{"seq":195275,"id":"CVE-2026-77092","ts":1789380554421,"field":"severity","old":"high","new":"critical"},{"seq":194063,"id":"CVE-2026-77092","ts":1789378659083,"field":"cvss","old":"9.8","new":"7.3"},{"seq":194062,"id":"CVE-2026-77092","ts":1789378659083,"field":"severity","old":"critical","new":"high"},{"seq":192850,"id":"CVE-2026-77092","ts":1789376488303,"field":"cvss","old":"7.3","new":"9.8"},{"seq":192849,"id":"CVE-2026-77092","ts":1789376488303,"field":"severity","old":"high","new":"critical"},{"seq":191637,"id":"CVE-2026-77092","ts":1789373581373,"field":"cvss","old":"9.8","new":"7.3"},{"seq":191636,"id":"CVE-2026-77092","ts":1789373581373,"field":"severity","old":"critical","new":"high"},{"seq":190422,"id":"CVE-2026-77092","ts":1789369427972,"field":"cvss","old":"7.3","new":"9.8"},{"seq":190421,"id":"CVE-2026-77092","ts":1789369427972,"field":"severity","old":"high","new":"critical"},{"seq":189209,"id":"CVE-2026-77092","ts":1789368355326,"field":"cvss","old":"9.8","new":"7.3"},{"seq":189208,"id":"CVE-2026-77092","ts":1789368355326,"field":"severity","old":"critical","new":"high"},{"seq":187992,"id":"CVE-2026-77092","ts":1789365208292,"field":"cvss","old":"7.3","new":"9.8"},{"seq":187991,"id":"CVE-2026-77092","ts":1789365208292,"field":"severity","old":"high","new":"critical"},{"seq":186779,"id":"CVE-2026-77092","ts":1789363436754,"field":"cvss","old":"9.8","new":"7.3"},{"seq":186778,"id":"CVE-2026-77092","ts":1789363436754,"field":"severity","old":"critical","new":"high"},{"seq":185565,"id":"CVE-2026-77092","ts":1789361192428,"field":"cvss","old":"7.3","new":"9.8"},{"seq":185564,"id":"CVE-2026-77092","ts":1789361192428,"field":"severity","old":"high","new":"critical"},{"seq":184352,"id":"CVE-2026-77092","ts":1789358300126,"field":"cvss","old":"9.8","new":"7.3"},{"seq":184351,"id":"CVE-2026-77092","ts":1789358300126,"field":"severity","old":"critical","new":"high"},{"seq":182603,"id":"CVE-2026-77092","ts":1789354298290,"field":"cvss","old":"7.3","new":"9.8"},{"seq":182602,"id":"CVE-2026-77092","ts":1789354298290,"field":"severity","old":"high","new":"critical"},{"seq":181396,"id":"CVE-2026-77092","ts":1789353262583,"field":"cvss","old":"9.8","new":"7.3"},{"seq":181395,"id":"CVE-2026-77092","ts":1789353262583,"field":"severity","old":"critical","new":"high"},{"seq":180189,"id":"CVE-2026-77092","ts":1789350253103,"field":"cvss","old":"7.3","new":"9.8"},{"seq":180188,"id":"CVE-2026-77092","ts":1789350253103,"field":"severity","old":"high","new":"critical"},{"seq":178982,"id":"CVE-2026-77092","ts":1789348249987,"field":"cvss","old":"9.8","new":"7.3"},{"seq":178981,"id":"CVE-2026-77092","ts":1789348249987,"field":"severity","old":"critical","new":"high"},{"seq":177775,"id":"CVE-2026-77092","ts":1789346351451,"field":"cvss","old":"7.3","new":"9.8"},{"seq":177774,"id":"CVE-2026-77092","ts":1789346351451,"field":"severity","old":"high","new":"critical"},{"seq":176568,"id":"CVE-2026-77092","ts":1789343154126,"field":"cvss","old":"9.8","new":"7.3"},{"seq":176567,"id":"CVE-2026-77092","ts":1789343154126,"field":"severity","old":"critical","new":"high"},{"seq":174685,"id":"CVE-2026-77092","ts":1789334847773,"field":"cvss","old":"7.3","new":"9.8"},{"seq":174684,"id":"CVE-2026-77092","ts":1789334847773,"field":"severity","old":"high","new":"critical"},{"seq":173480,"id":"CVE-2026-77092","ts":1789333636696,"field":"cvss","old":"9.8","new":"7.3"},{"seq":173479,"id":"CVE-2026-77092","ts":1789333636696,"field":"severity","old":"critical","new":"high"},{"seq":172294,"id":"CVE-2026-77092","ts":1789331073838,"field":"cvss","old":"7.3","new":"9.8"},{"seq":172293,"id":"CVE-2026-77092","ts":1789331073838,"field":"severity","old":"high","new":"critical"}]}