Cloud vulnerabilities
CVEs whose affected-version data names the Cloud package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
12 CVEsRSS
CVE-2026-96376NoneCloud - Critical - Remote code execution - SA-CONTRIB-2026-177
Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1.
CVE-2026-96375NoneCloud - Critical - Remote code execution - SA-CONTRIB-2026-176
Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.
CVE-2026-97334High· 8.7The network messaging layer contained improper handling of highly compressed data affecting service availability
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server…
CVE-2026-97333High· 7.1QAPI contained a stack-based buffer overflow affecting service availability
QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.
CVE-2026-77100High· 8.7MediaAgent contained a heap-based buffer overflow issue affecting service availability
MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.
CVE-2026-77099Critical· 9.3CVFS contained an input validation issue affecting command execution
CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
CVE-2026-77096High· 7.7CVFS contained a missing authentication condition affecting command execution
CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
CVE-2026-77095High· 7.1CvFWD contained a null pointer dereference affecting service availability
CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clie…
CVE-2026-77094High· 7.1CvFWD contained an out-of-bounds write affecting service availability
CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including…
CVE-2026-77093High· 7.1CvFWD contained an integer overflow affecting service availability
CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and…
CVE-2026-77090High· 8.7CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.
CVE-2026-18228High· 7.1HyperScale contained a path traversal issue affecting information disclosure
HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.