Commvault has 25 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 24 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 11. The median CVSS is 8.7 (high), with 7 rated critical. 4% have been exploited in the wild, in line with the corpus average. The most common weakness class is CWE-22 (3). Most affected products: commvault (15), Commvault Cloud (10).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 4% vs 1% corpus
- Median CVSS
- 8.7
- Publish → KEV
- —(1)
- Last 90 days
- 24 prev 0
Worst active — by depth score
CVE-2025-3928High· 8.8Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker74CVE-2026-77098Critical· 9.8Private Metrics Server contained an SQL injection condition affecting database operations54CVE-2026-77092Critical· 9.8Content Extractor contained a deserialization of untrusted data issue affecting privilege management54CVE-2026-77089Critical· 9.8Command Center API contained an authentication bypass issue affecting privilege management54CVE-2026-13739Critical· 9.8A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs54
Commvault vulnerabilities
CVEs affecting Commvault, newest first. Open any entry for full detail, references, and exploit status.
25 CVEsRSS
CVE-2026-97334High· 8.7The network messaging layer contained improper handling of highly compressed data affecting service availability
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server…
CVE-2026-97333High· 7.1QAPI contained a stack-based buffer overflow affecting service availability
QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.
CVE-2026-77100High· 8.7MediaAgent contained a heap-based buffer overflow issue affecting service availability
MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and HyperScale.
CVE-2026-77099Critical· 9.3CVFS contained an input validation issue affecting command execution
CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
CVE-2026-77096High· 7.7CVFS contained a missing authentication condition affecting command execution
CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
CVE-2026-77095High· 7.1CvFWD contained a null pointer dereference affecting service availability
CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clie…
CVE-2026-77094High· 7.1CvFWD contained an out-of-bounds write affecting service availability
CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including…
CVE-2026-77093High· 7.1CvFWD contained an integer overflow affecting service availability
CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and…
CVE-2026-77090High· 8.7CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.
CVE-2026-18228High· 7.1HyperScale contained a path traversal issue affecting information disclosure
HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.
CVE-2026-77106High· 8.8Cvlaunchd contained a missing authorization issue affecting command execution authorization
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, …
CVE-2026-77105High· 8.8CommServe contained a cryptographic signature verification issue affecting privilege management
CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server.
CVE-2026-77104High· 7.5CommServe contained a path traversal issue affecting information disclosure
CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.
CVE-2026-77103High· 7.5CommServe contained an authentication bypass issue affecting access authorization and information disclosure
CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.
CVE-2026-77102High· 7.5CommServe contained a heap-based buffer overflow issue affecting service availability
CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.
CVE-2026-77101High· 7.5CommServe contained a stack-based buffer overflow issue affecting service availability
CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.
CVE-2026-77098Critical· 9.8Private Metrics Server contained an SQL injection condition affecting database operations
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.
CVE-2026-77097High· 8.2Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability
Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.
CVE-2026-77092Critical· 9.8⚖ disputedContent Extractor contained a deserialization of untrusted data issue affecting privilege management
Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.
CVE-2026-77091High· 7.8DataCube contained a path traversal issue affecting security feature enforcement
DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.
CVE-2026-77089Critical· 9.8Command Center API contained an authentication bypass issue affecting privilege management
Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.
CVE-2026-13738Critical· 9.8CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations
CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Web…
CVE-2026-13739Critical· 9.8A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs
A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Comm…
CVE-2026-13737Critical· 9.8CommServe contained an allowlist bypass vulnerability affecting command execution authorization
CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Cen…
CVE-2025-3928High· 8.8CISA KEVPoCCommvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fi…