{"id":"CVE-2026-77097","title":"Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability","summary":"Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cwe":["CWE-306"],"vendor":"commvault","product":"commvault","affected":["commvault >= 11.36.0, < 11.36.123","commvault >= 11.40.0, < 11.40.72","commvault >= 11.44.0, < 11.44.20","commvault >= 11.46.0, < 11.46.20"],"patched":["commvault 11.46.20"],"published":"2026-09-08","updated":"2026-09-11","sourceUpdated":"2026-09-11T14:20:07.420","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77097","references":[{"url":"https://documentation.commvault.com/securityadvisories/CV_2026_08_1.html","label":"050066fd-a2f9-4f32-ab5d-4c53f48bc333"}],"tags":["nvd","cve.org"],"epss":0.00257,"epssPercentile":0.17685,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-08T13:30:12.896266Z"},"scores":{"nvd":8.2,"cna":8.8},"ingestedAt":"2026-09-08T15:33:26.984Z","slug":"CVE-2026-77097","body":"## Overview\n\nPrivate Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.\n\n## Affected\n\n- `commvault >= 11.36.0, < 11.36.123`\n- `commvault >= 11.40.0, < 11.40.72`\n- `commvault >= 11.44.0, < 11.44.20`\n- `commvault >= 11.46.0, < 11.46.20`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `commvault 11.46.20`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201920,"id":"CVE-2026-77097","ts":1789399986776,"field":"cvss","old":"8.8","new":"8.2"},{"seq":200650,"id":"CVE-2026-77097","ts":1789397562679,"field":"cvss","old":"8.2","new":"8.8"},{"seq":199357,"id":"CVE-2026-77097","ts":1789395472329,"field":"cvss","old":"8.8","new":"8.2"},{"seq":198602,"id":"CVE-2026-77097","ts":1789392166716,"field":"cvss","old":"8.2","new":"8.8"},{"seq":198557,"id":"CVE-2026-77097","ts":1789392092756,"field":"cvss","old":"8.8","new":"8.2"},{"seq":196348,"id":"CVE-2026-77097","ts":1789383734874,"field":"cvss","old":"8.2","new":"8.8"},{"seq":195277,"id":"CVE-2026-77097","ts":1789380554429,"field":"cvss","old":"8.8","new":"8.2"},{"seq":194064,"id":"CVE-2026-77097","ts":1789378659090,"field":"cvss","old":"8.2","new":"8.8"},{"seq":192851,"id":"CVE-2026-77097","ts":1789376488309,"field":"cvss","old":"8.8","new":"8.2"},{"seq":191638,"id":"CVE-2026-77097","ts":1789373581381,"field":"cvss","old":"8.2","new":"8.8"},{"seq":190423,"id":"CVE-2026-77097","ts":1789369427980,"field":"cvss","old":"8.8","new":"8.2"},{"seq":189210,"id":"CVE-2026-77097","ts":1789368355333,"field":"cvss","old":"8.2","new":"8.8"},{"seq":187993,"id":"CVE-2026-77097","ts":1789365208299,"field":"cvss","old":"8.8","new":"8.2"},{"seq":186780,"id":"CVE-2026-77097","ts":1789363436761,"field":"cvss","old":"8.2","new":"8.8"},{"seq":185566,"id":"CVE-2026-77097","ts":1789361192435,"field":"cvss","old":"8.8","new":"8.2"},{"seq":184353,"id":"CVE-2026-77097","ts":1789358300133,"field":"cvss","old":"8.2","new":"8.8"},{"seq":182604,"id":"CVE-2026-77097","ts":1789354298296,"field":"cvss","old":"8.8","new":"8.2"},{"seq":181397,"id":"CVE-2026-77097","ts":1789353262590,"field":"cvss","old":"8.2","new":"8.8"},{"seq":180190,"id":"CVE-2026-77097","ts":1789350253110,"field":"cvss","old":"8.8","new":"8.2"},{"seq":178983,"id":"CVE-2026-77097","ts":1789348249994,"field":"cvss","old":"8.2","new":"8.8"},{"seq":177776,"id":"CVE-2026-77097","ts":1789346351457,"field":"cvss","old":"8.8","new":"8.2"},{"seq":176569,"id":"CVE-2026-77097","ts":1789343154133,"field":"cvss","old":"8.2","new":"8.8"},{"seq":174686,"id":"CVE-2026-77097","ts":1789334847780,"field":"cvss","old":"8.8","new":"8.2"},{"seq":173481,"id":"CVE-2026-77097","ts":1789333636856,"field":"cvss","old":"8.2","new":"8.8"},{"seq":172295,"id":"CVE-2026-77097","ts":1789331073845,"field":"cvss","old":"8.8","new":"8.2"},{"seq":171109,"id":"CVE-2026-77097","ts":1789328735670,"field":"cvss","old":"8.2","new":"8.8"},{"seq":169904,"id":"CVE-2026-77097","ts":1789327137640,"field":"cvss","old":"8.8","new":"8.2"},{"seq":168699,"id":"CVE-2026-77097","ts":1789323793770,"field":"cvss","old":"8.2","new":"8.8"},{"seq":167494,"id":"CVE-2026-77097","ts":1789319663883,"field":"cvss","old":"8.8","new":"8.2"},{"seq":166289,"id":"CVE-2026-77097","ts":1789318721177,"field":"cvss","old":"8.2","new":"8.8"},{"seq":165084,"id":"CVE-2026-77097","ts":1789315769474,"field":"cvss","old":"8.8","new":"8.2"},{"seq":163879,"id":"CVE-2026-77097","ts":1789313590180,"field":"cvss","old":"8.2","new":"8.8"},{"seq":162674,"id":"CVE-2026-77097","ts":1789311882217,"field":"cvss","old":"8.8","new":"8.2"},{"seq":161469,"id":"CVE-2026-77097","ts":1789308680098,"field":"cvss","old":"8.2","new":"8.8"},{"seq":159582,"id":"CVE-2026-77097","ts":1789300451901,"field":"cvss","old":"8.8","new":"8.2"},{"seq":156571,"id":"CVE-2026-77097","ts":1789294723442,"field":"cvss","old":"8.2","new":"8.8"},{"seq":155366,"id":"CVE-2026-77097","ts":1789292913525,"field":"cvss","old":"8.8","new":"8.2"},{"seq":154161,"id":"CVE-2026-77097","ts":1789289749478,"field":"cvss","old":"8.2","new":"8.8"},{"seq":152811,"id":"CVE-2026-77097","ts":1789281652856,"field":"cvss","old":"8.8","new":"8.2"},{"seq":152451,"id":"CVE-2026-77097","ts":1789281224495,"field":"cvss","old":"8.2","new":"8.8"},{"seq":151412,"id":"CVE-2026-77097","ts":1789277607475,"field":"cvss","old":"8.8","new":"8.2"},{"seq":150373,"id":"CVE-2026-77097","ts":1789276209917,"field":"cvss","old":"8.2","new":"8.8"},{"seq":149340,"id":"CVE-2026-77097","ts":1789273803764,"field":"cvss","old":"8.8","new":"8.2"},{"seq":148307,"id":"CVE-2026-77097","ts":1789271294404,"field":"cvss","old":"8.2","new":"8.8"},{"seq":146339,"id":"CVE-2026-77097","ts":1789269357675,"field":"cvss","old":"8.8","new":"8.2"},{"seq":145144,"id":"CVE-2026-77097","ts":1789266305275,"field":"cvss","old":"8.2","new":"8.8"},{"seq":144048,"id":"CVE-2026-77097","ts":1789262586148,"field":"cvss","old":"8.8","new":"8.2"},{"seq":142952,"id":"CVE-2026-77097","ts":1789261486061,"field":"cvss","old":"8.2","new":"8.8"},{"seq":141783,"id":"CVE-2026-77097","ts":1789258811184,"field":"cvss","old":"8.8","new":"8.2"},{"seq":140624,"id":"CVE-2026-77097","ts":1789256700646,"field":"cvss","old":"8.2","new":"8.8"}]}