Critical severity · published Aug 11, 2026
CVE-2026-13738
Improper Authorization Validation
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Commvault Cloud · Commvault
11.46.0 through 11.46.9; 11.44.0 through 11.44.10; 11.40.0 through 11.40.62; 11.36.0 through 11.36.113 · source: vendor
CO
Commvault · Commvault
11.36.0 before 11.36.114; 11.40.0 before 11.40.63; 11.44.0 before 11.44.11; 11.46.0 before 11.46.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-13738
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-13738
Vendor Advisory
https://documentation.commvault.com/securityadvisories/CV_2026_07_9.html
More from Commvault Cloud
9.8
CVE-2026-77098
Private Metrics Server SQL Injection
9.8
CVE-2026-77092
Content Extractor Privilege Escalation
9.8
CVE-2026-77089
Command Center API Authentication Bypass
9.8
CVE-2026-13737
Command Restriction Bypass
9.8
CVE-2026-13739
Server-Side Request Forgery (SSRF)