{"id":"CVE-2026-77098","title":"Private Metrics Server contained an SQL injection condition affecting database operations","summary":"Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-89"],"vendor":"commvault","product":"commvault","affected":["commvault >= 11.36.0, < 11.36.123","commvault >= 11.40.0, < 11.40.72","commvault >= 11.44.0, < 11.44.20","commvault >= 11.46.0, < 11.46.20"],"patched":["commvault 11.46.20"],"published":"2026-09-08","updated":"2026-09-11","sourceUpdated":"2026-09-11T14:19:39.437","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77098","references":[{"url":"https://documentation.commvault.com/securityadvisories/CV_2026_08_2.html","label":"050066fd-a2f9-4f32-ab5d-4c53f48bc333"}],"tags":["nvd","cve.org"],"epss":0.0026,"epssPercentile":0.18062,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-08T13:27:02.935632Z"},"scores":{"nvd":9.8,"cna":8.8},"ingestedAt":"2026-09-08T15:33:26.984Z","slug":"CVE-2026-77098","body":"## Overview\n\nPrivate Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.\n\n## Affected\n\n- `commvault >= 11.36.0, < 11.36.123`\n- `commvault >= 11.40.0, < 11.40.72`\n- `commvault >= 11.44.0, < 11.44.20`\n- `commvault >= 11.46.0, < 11.46.20`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `commvault 11.46.20`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201922,"id":"CVE-2026-77098","ts":1789399986785,"field":"cvss","old":"8.8","new":"9.8"},{"seq":201921,"id":"CVE-2026-77098","ts":1789399986785,"field":"severity","old":"high","new":"critical"},{"seq":200652,"id":"CVE-2026-77098","ts":1789397562686,"field":"cvss","old":"9.8","new":"8.8"},{"seq":200651,"id":"CVE-2026-77098","ts":1789397562686,"field":"severity","old":"critical","new":"high"},{"seq":199359,"id":"CVE-2026-77098","ts":1789395472344,"field":"cvss","old":"8.8","new":"9.8"},{"seq":199358,"id":"CVE-2026-77098","ts":1789395472344,"field":"severity","old":"high","new":"critical"},{"seq":198604,"id":"CVE-2026-77098","ts":1789392166724,"field":"cvss","old":"9.8","new":"8.8"},{"seq":198603,"id":"CVE-2026-77098","ts":1789392166724,"field":"severity","old":"critical","new":"high"},{"seq":198559,"id":"CVE-2026-77098","ts":1789392092763,"field":"cvss","old":"8.8","new":"9.8"},{"seq":198558,"id":"CVE-2026-77098","ts":1789392092763,"field":"severity","old":"high","new":"critical"},{"seq":196350,"id":"CVE-2026-77098","ts":1789383734880,"field":"cvss","old":"9.8","new":"8.8"},{"seq":196349,"id":"CVE-2026-77098","ts":1789383734880,"field":"severity","old":"critical","new":"high"},{"seq":195279,"id":"CVE-2026-77098","ts":1789380554436,"field":"cvss","old":"8.8","new":"9.8"},{"seq":195278,"id":"CVE-2026-77098","ts":1789380554436,"field":"severity","old":"high","new":"critical"},{"seq":194066,"id":"CVE-2026-77098","ts":1789378659097,"field":"cvss","old":"9.8","new":"8.8"},{"seq":194065,"id":"CVE-2026-77098","ts":1789378659097,"field":"severity","old":"critical","new":"high"},{"seq":192853,"id":"CVE-2026-77098","ts":1789376488315,"field":"cvss","old":"8.8","new":"9.8"},{"seq":192852,"id":"CVE-2026-77098","ts":1789376488315,"field":"severity","old":"high","new":"critical"},{"seq":191640,"id":"CVE-2026-77098","ts":1789373581390,"field":"cvss","old":"9.8","new":"8.8"},{"seq":191639,"id":"CVE-2026-77098","ts":1789373581390,"field":"severity","old":"critical","new":"high"},{"seq":190425,"id":"CVE-2026-77098","ts":1789369427988,"field":"cvss","old":"8.8","new":"9.8"},{"seq":190424,"id":"CVE-2026-77098","ts":1789369427988,"field":"severity","old":"high","new":"critical"},{"seq":189212,"id":"CVE-2026-77098","ts":1789368355340,"field":"cvss","old":"9.8","new":"8.8"},{"seq":189211,"id":"CVE-2026-77098","ts":1789368355340,"field":"severity","old":"critical","new":"high"},{"seq":187995,"id":"CVE-2026-77098","ts":1789365208305,"field":"cvss","old":"8.8","new":"9.8"},{"seq":187994,"id":"CVE-2026-77098","ts":1789365208305,"field":"severity","old":"high","new":"critical"},{"seq":186782,"id":"CVE-2026-77098","ts":1789363436768,"field":"cvss","old":"9.8","new":"8.8"},{"seq":186781,"id":"CVE-2026-77098","ts":1789363436768,"field":"severity","old":"critical","new":"high"},{"seq":185568,"id":"CVE-2026-77098","ts":1789361192441,"field":"cvss","old":"8.8","new":"9.8"},{"seq":185567,"id":"CVE-2026-77098","ts":1789361192441,"field":"severity","old":"high","new":"critical"},{"seq":184355,"id":"CVE-2026-77098","ts":1789358300140,"field":"cvss","old":"9.8","new":"8.8"},{"seq":184354,"id":"CVE-2026-77098","ts":1789358300140,"field":"severity","old":"critical","new":"high"},{"seq":182606,"id":"CVE-2026-77098","ts":1789354298303,"field":"cvss","old":"8.8","new":"9.8"},{"seq":182605,"id":"CVE-2026-77098","ts":1789354298303,"field":"severity","old":"high","new":"critical"},{"seq":181399,"id":"CVE-2026-77098","ts":1789353262597,"field":"cvss","old":"9.8","new":"8.8"},{"seq":181398,"id":"CVE-2026-77098","ts":1789353262597,"field":"severity","old":"critical","new":"high"},{"seq":180192,"id":"CVE-2026-77098","ts":1789350253118,"field":"cvss","old":"8.8","new":"9.8"},{"seq":180191,"id":"CVE-2026-77098","ts":1789350253118,"field":"severity","old":"high","new":"critical"},{"seq":178985,"id":"CVE-2026-77098","ts":1789348250000,"field":"cvss","old":"9.8","new":"8.8"},{"seq":178984,"id":"CVE-2026-77098","ts":1789348250000,"field":"severity","old":"critical","new":"high"},{"seq":177778,"id":"CVE-2026-77098","ts":1789346351465,"field":"cvss","old":"8.8","new":"9.8"},{"seq":177777,"id":"CVE-2026-77098","ts":1789346351465,"field":"severity","old":"high","new":"critical"},{"seq":176571,"id":"CVE-2026-77098","ts":1789343154139,"field":"cvss","old":"9.8","new":"8.8"},{"seq":176570,"id":"CVE-2026-77098","ts":1789343154139,"field":"severity","old":"critical","new":"high"},{"seq":174688,"id":"CVE-2026-77098","ts":1789334847786,"field":"cvss","old":"8.8","new":"9.8"},{"seq":174687,"id":"CVE-2026-77098","ts":1789334847786,"field":"severity","old":"high","new":"critical"},{"seq":173483,"id":"CVE-2026-77098","ts":1789333637016,"field":"cvss","old":"9.8","new":"8.8"},{"seq":173482,"id":"CVE-2026-77098","ts":1789333637016,"field":"severity","old":"critical","new":"high"},{"seq":172297,"id":"CVE-2026-77098","ts":1789331073851,"field":"cvss","old":"8.8","new":"9.8"},{"seq":172296,"id":"CVE-2026-77098","ts":1789331073851,"field":"severity","old":"high","new":"critical"}]}