SB2026090846 - Multiple vulnerabilities in Commvault

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090846

SB2026090846 - Multiple vulnerabilities in Commvault

Published: September 8, 2026

Security Bulletin ID SB2026090846
CSH Severity
High
Patch available
YES
Number of vulnerabilities 12
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 17% Medium 50% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 12 vulnerabilities.


1) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2026-77089)

CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to an authentication bypass in the Command Center API when handling API requests. A remote attacker can bypass authentication to compromise confidentiality, integrity, and availability.


2) Path traversal (CVE-ID: CVE-2026-77091)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to bypass security feature enforcement.

The vulnerability exists due to path traversal in DataCube when processing path names. A local user can exploit the path traversal issue to bypass security feature enforcement.


3) Deserialization of Untrusted Data (CVE-ID: CVE-2026-77092)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to deserialization of untrusted data in Content Extractor when processing untrusted serialized data. A local user can supply malicious serialized data to escalate privileges.


4) External Control of File Name or Path (CVE-ID: N/A)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to external control of file name or path in Content Extractor when processing an externally controlled file name or path. A local user can provide an externally controlled file name or path to disclose sensitive information.


5) Missing Authentication for Critical Function (CVE-ID: CVE-2026-77097)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing authentication in Private Metrics Server metrics upload functionality when handling metrics uploads. A remote attacker can submit metrics uploads without authentication to cause a denial of service.


6) SQL injection (CVE-ID: CVE-2026-77098)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information, modify data, and cause a denial of service.

The vulnerability exists due to SQL injection in Private Metrics Server when processing database operations. A remote attacker can submit crafted SQL input to disclose sensitive information, modify data, and cause a denial of service.


7) Stack-based buffer overflow (CVE-ID: CVE-2026-77101)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in CommServe when handling network requests. A remote attacker can send input that triggers the overflow to cause a denial of service.


8) Heap-based buffer overflow (CVE-ID: CVE-2026-77102)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in CommServe when processing network-supplied input. A remote attacker can interact with the affected service to cause a denial of service.


9) Improper Authentication (CVE-ID: CVE-2026-77103)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper authentication in CommServe when attempting to access protected functionality. A remote attacker can bypass authentication to disclose sensitive information.


10) Path traversal (CVE-ID: CVE-2026-77104)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in CommServe when handling crafted requests. A remote attacker can send a crafted request containing path traversal sequences to disclose sensitive information.


11) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-77105)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper verification of cryptographic signatures in CommServe privilege management when processing cryptographic signatures for privilege management. A remote user can exploit the signature verification issue to escalate privileges.


12) Missing Authorization (CVE-ID: CVE-2026-77106)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute unauthorized commands.

The vulnerability exists due to missing authorization in Cvlaunchd when handling command execution requests. A remote user can submit a command execution request to execute unauthorized commands.

Exploitation requires conditions beyond the attacker's control.


Remediation

Install update from vendor's website.

References