Critical severity · published Aug 11, 2026
CVE-2026-13737
Command Restriction Bypass
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Commvault Cloud · Commvault
11.46.0 through 11.46.9; 11.44.0 through 11.44.10; 11.40.0 through 11.40.62; 11.36.0 through 11.36.113 · source: vendor
CO
Commvault · Commvault
11.36.0 before 11.36.114; 11.40.0 before 11.40.63; 11.44.0 before 11.44.11; 11.46.0 before 11.46.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-13737
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-13737
Vendor Advisory
https://documentation.commvault.com/securityadvisories/CV_2026_07_8.html
More from Commvault Cloud
9.8
CVE-2026-77098
Private Metrics Server SQL Injection
9.8
CVE-2026-77092
Content Extractor Privilege Escalation
9.8
CVE-2026-77089
Command Center API Authentication Bypass
9.8
CVE-2026-13738
Improper Authorization Validation
9.8
CVE-2026-13739
Server-Side Request Forgery (SSRF)