en
Commvault is a multinational provider of data protection and information management software. It delivers cloud-native resilience through Commvault Cloud, enabling unified protection, recovery, and identity resilience across diverse infrastructures and platforms.
As of 09/15/2026, Commvault recorded 14 security vulnerabilities in the last 90 days across 1 products, including 14 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Commvault Cloud had the most security vulnerabilities in the Commvault ecosystem, with 14 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-77106Cvlaunchd Code Execution | Exploitation statusNot known exploited | FixYes | Affected productCommvault Cloud | Published09/08/2026 | SeverityHigh |
CVE-2026-77105CommServe Privilege Escalation | Exploitation statusNot known exploited | FixYes | Affected productCommvault Cloud | Published09/08/2026 | SeverityHigh |
CVE-2026-77104CommServe Path Traversal | Exploitation statusNot known exploited | FixYes | Affected productCommvault Cloud | Published09/08/2026 | SeverityHigh |
CVE-2026-77103CommServe Information Disclosure | Exploitation statusNot known exploited | FixYes | Affected productCommvault Cloud | Published09/08/2026 | SeverityHigh |
CVE-2026-77102CommServe Denial of Service | Exploitation statusNot known exploited | FixYes | Affected productCommvault Cloud | Published09/08/2026 | SeverityHigh |
CVE-2026-77101CommServe Stack-based Buffer Overflow | Exploitation statusNot known exploited | FixYes | Affected productCommvault Cloud | Published09/08/2026 | SeverityHigh |
CVE-2026-77098Private Metrics Server SQL Injection | Exploitation statusNot known exploited | FixYes | Affected productCommvault Cloud | Published09/08/2026 | SeverityHigh |
CVE-2026-77097Private Metrics Server Denial of Service | Exploitation statusNot known exploited | FixYes | Affected productCommvault Cloud | Published09/08/2026 | SeverityHigh |
CVE-2026-77092Content Extractor Privilege Escalation | Exploitation statusNot known exploited | FixYes | Affected productCommvault Cloud | Published09/08/2026 | SeverityHigh |
CVE-2026-77091DataCube Security Feature Bypass | Exploitation statusNot known exploited | FixYes | Affected productCommvault Cloud | Published09/08/2026 | SeverityHigh |
CVE-2026-77089Command Center API Authentication Bypass | Exploitation statusNot known exploited | FixYes | Affected productCommvault Cloud | Published09/08/2026 | SeverityCritical |
CVE-2026-13738Improper Authorization Validation | Exploitation statusNot known exploited | FixYes | Affected productCommvault Cloud | Published08/11/2026 | SeverityCritical |
CVE-2026-13737Command Restriction Bypass | Exploitation statusNot known exploited | FixYes | Affected productCommvault Cloud | Published08/11/2026 | SeverityCritical |
CVE-2026-13739Server-Side Request Forgery (SSRF) | Exploitation statusNot known exploited | FixYes | Affected productCommvault Cloud | Published08/11/2026 | SeverityHigh |
CVE-2025-12776Stored Cross-Site Scripting | Exploitation statusNot known exploited | FixYes | Affected productWebConsole | Published01/07/2026 | SeverityLow |
CVE-2025-57791Argument Injection Vulnerability in CommServe | Exploitation statusNot known exploited | FixYes | Affected productCommCell | Published08/20/2025 | SeverityMedium |
CVE-2025-57790Path Traversal Vulnerability | Exploitation statusNot known exploited | FixYes | Affected productCommCell | Published08/20/2025 | SeverityHigh |
CVE-2025-57789Vulnerability in Initial Administrator Login Process | Exploitation statusNot known exploited | FixYes | Affected productCommCell | Published08/20/2025 | SeverityMedium |
CVE-2025-57788Unauthorized API Access Risk | Exploitation statusNot known exploited | FixYes | Affected productCommCell | Published08/20/2025 | SeverityMedium |
CVE-2024-13976Commvault 11.20.0 - 11.36.0 Windows Maintenance Installer DLL Injection | Exploitation statusNot known exploited | FixYes | Affected productCommvault for Windows | Published07/25/2025 | SeverityHigh |
CVE-2024-13975Commvault 11.20.0 - 11.36.0 Windows Access Nodes Compromise via Local File Server Agent Abuse | Exploitation statusNot known exploited | FixYes | Affected productCommvault | Published07/25/2025 | SeverityHigh |
CVE-2025-34136Commvault CommServe Web Server Unauthenticated SQL Injection | Exploitation statusNot known exploited | FixYes | Affected productCommvault | Published07/25/2025 | SeverityMedium |
CVE-2025-3928Commvault Web Server unspecified vulnerability | Exploitation statusKEV | FixYes | Affected productWeb Server | Published04/25/2025 | SeverityHigh |
CVE-2025-34028Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal | Exploitation statusKEV | FixYes | Affected productCommand Center Innovation Release | Published04/22/2025 | SeverityCritical |
CVE-2021-34997 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCommCell | Published01/13/2022 | SeverityHigh |
CVE-2021-34996 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCommCell | Published01/13/2022 | SeverityHigh |
CVE-2021-34995 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCommCell | Published01/13/2022 | SeverityHigh |
CVE-2021-34994 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCommCell | Published01/13/2022 | SeverityHigh |
CVE-2021-34993 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCommCell | Published01/13/2022 | SeverityCritical |
CVE-2020-25780 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/29/2020 | SeverityUnknown |
CVE-2017-18044 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/19/2018 | SeverityUnknown |
CVE-2017-3195 | Exploitation statusPublic exploit | FixNot confirmed | Affected productService Pack 6 | Published12/15/2017 | SeverityUnknown |
CVE-2015-7253 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/04/2015 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
