High severity · published Sep 8, 2026
CVE-2026-77106
Cvlaunchd Code Execution
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Commvault Cloud · Commvault
11.46.0 through 11.46.19; 11.44.0 through 11.44.19; 11.40.0 through 11.40.71; 11.36.0 through 11.36.122 · source: vendor
CO
Commvault · Commvault
11.36.0 before 11.36.123; 11.40.0 before 11.40.72; 11.44.0 before 11.44.20; 11.46.0 before 11.46.20 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77106
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77106
Vendor Advisory
https://documentation.commvault.com/securityadvisories/CV_2026_08_8.html
More from Commvault Cloud
9.8
CVE-2026-77098
Private Metrics Server SQL Injection
9.8
CVE-2026-77092
Content Extractor Privilege Escalation
9.8
CVE-2026-77089
Command Center API Authentication Bypass
9.8
CVE-2026-13738
Improper Authorization Validation
9.8
CVE-2026-13737
Command Restriction Bypass