CO
Product
Commvault
On CISA KEVExploited in the wild
22
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 8High 10Medium 4Low 0
Watch
Add Commvault to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-34028 In wildKEV | 10.0 | Apr 22 | Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal Affected: 11.38.0 before 11.38.20 |
| CVE-2025-3928 In wildKEV | 8.8 | Apr 25 | Commvault Web Server unspecified vulnerability Affected: 11.20.0 before 11.20.217; 11.28.0 before 11.28.141; 11.32.0 before 11.32.89; 11.36.0 before 11.36.46 |
| CVE-2026-77098 | 9.8 | Sep 8 | Private Metrics Server SQL Injection Affected: 11.36.0 before 11.36.123; 11.40.0 before 11.40.72; 11.44.0 before 11.44.20; 11.46.0 before 11.46.20 |
| CVE-2026-77092 | 9.8 | Sep 8 | Content Extractor Privilege Escalation Affected: 11.36.0 before 11.36.123; 11.40.0 before 11.40.72; 11.44.0 before 11.44.20; 11.46.0 before 11.46.20 |
| CVE-2026-77089 | 9.8 | Sep 8 | Command Center API Authentication Bypass Affected: 11.36.0 before 11.36.123; 11.40.0 before 11.40.72; 11.44.0 before 11.44.20; 11.46.0 before 11.46.20 |
| CVE-2026-13738 | 9.8 | Aug 11 | Improper Authorization Validation Affected: 11.36.0 before 11.36.114; 11.40.0 before 11.40.63; 11.44.0 before 11.44.11; 11.46.0 before 11.46.10 |
| CVE-2026-13737 | 9.8 | Aug 11 | Command Restriction Bypass Affected: 11.36.0 before 11.36.114; 11.40.0 before 11.40.63; 11.44.0 before 11.44.11; 11.46.0 before 11.46.10 |
| CVE-2026-13739 | 9.8 | Aug 11 | Server-Side Request Forgery (SSRF) Affected: 11.36.0 before 11.36.114; 11.40.0 before 11.40.63; 11.44.0 before 11.44.11; 11.46.0 before 11.46.10 |
| CVE-2017-18044 | 9.8 | Jan 19 | A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6 Affected: 11.0; 11.0; 11.0; 11.0; 11.0; through 11.0 |
| CVE-2026-77106 | 8.8 | Sep 8 | Cvlaunchd Code Execution Affected: 11.36.0 before 11.36.123; 11.40.0 before 11.40.72; 11.44.0 before 11.44.20; 11.46.0 before 11.46.20 |
| CVE-2026-77105 | 8.8 | Sep 8 | CommServe Privilege Escalation Affected: 11.36.0 before 11.36.123; 11.40.0 before 11.40.72; 11.44.0 before 11.44.20; 11.46.0 before 11.46.20 |
| CVE-2025-57790 | 8.8 | Aug 20 | A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue Affected: before 11.36.60 |
| CVE-2026-77097 | 8.2 | Sep 8 | Private Metrics Server Denial of Service Affected: 11.36.0 before 11.36.123; 11.40.0 before 11.40.72; 11.44.0 before 11.44.20; 11.46.0 before 11.46.20 |
| CVE-2026-77091 | 7.8 | Sep 8 | DataCube Security Feature Bypass Affected: 11.36.0 before 11.36.123; 11.40.0 before 11.40.72; 11.44.0 before 11.44.20; 11.46.0 before 11.46.20 |
| CVE-2026-77104 | 7.5 | Sep 8 | CommServe Path Traversal Affected: 11.36.0 before 11.36.123; 11.40.0 before 11.40.72; 11.44.0 before 11.44.20; 11.46.0 before 11.46.20 |
| CVE-2026-77103 | 7.5 | Sep 8 | CommServe Information Disclosure Affected: 11.36.0 before 11.36.123; 11.40.0 before 11.40.72; 11.44.0 before 11.44.20; 11.46.0 before 11.46.20 |
| CVE-2026-77102 | 7.5 | Sep 8 | CommServe Denial of Service Affected: 11.36.0 before 11.36.123; 11.40.0 before 11.40.72; 11.44.0 before 11.44.20; 11.46.0 before 11.46.20 |
| CVE-2026-77101 | 7.5 | Sep 8 | CommServe Stack-based Buffer Overflow Affected: 11.36.0 before 11.36.123; 11.40.0 before 11.40.72; 11.44.0 before 11.44.20; 11.46.0 before 11.46.20 |
| CVE-2025-57791 | 6.5 | Aug 20 | A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input… Affected: before 11.36.60 |
| CVE-2025-57788 | 6.5 | Aug 20 | A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials Affected: before 11.36.60 |
| CVE-2025-12776 | 5.4 | Jan 7 | The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site… Affected: 11.36.0 through 11.36.68; 11.32.0 through 11.32.112 |
| CVE-2025-57789 | 5.4 | Aug 20 | During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control Affected: before 11.36.60 |
Showing 22