CO
Vendor
Commvault
60
CVEs
5
On KEV
13
New 30D
Products
CC9.8
Commvault Cloud
Commvault
24 CVEs0 on KEV10 new
GC9.3
Grid(HSX) CVFS
Commvault
3 CVEs0 on KEV3 new
CO10.0
Commvault
Commvault
22 CVEs2 on KEV0 new
CC10.0
Command Center
Commvault
1 CVEs1 on KEV0 new
CC10.0
Command Center Innovation Release
Commvault
1 CVEs1 on KEV0 new
WS8.8
Web Server
Commvault
1 CVEs1 on KEV0 new
CO9.8
Commcell
Commvault
6 CVEs0 on KEV0 new
ED9.8
Edge
Commvault
1 CVEs0 on KEV0 new
ES–
Edge Server
Commvault
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-97334 | CC Commvault Cloud Commvault | 8.7 | Oct 13 | Network messaging layer decompression resource exhaustion |
| CVE-2026-97333 | CC Commvault Cloud Commvault | 7.1 | Oct 13 | QAPI stack-based buffer overflow |
| CVE-2026-77100 | CC Commvault Cloud Commvault | 8.7 | Oct 13 | MediaAgent Denial of Service |
| CVE-2026-77099 | CC Commvault Cloud Commvault | 9.3 | Oct 13 | CVFS Command Execution |
| CVE-2026-77096 | CC Commvault Cloud Commvault | 7.7 | Oct 13 | CVFS Missing Authentication |
| CVE-2026-77095 | CC Commvault Cloud Commvault | 7.1 | Oct 13 | CvFWD Null Pointer Dereference |
| CVE-2026-77094 | CC Commvault Cloud Commvault | 7.1 | Oct 13 | CvFWD Out-of-Bounds Write |
| CVE-2026-77093 | CC Commvault Cloud Commvault | 7.1 | Oct 13 | CvFWD Denial of Service |
| CVE-2026-77090 | GC Grid(HSX) CVFS Commvault | 8.7 | Oct 13 | CVFS Information Disclosure |
| CVE-2026-18228 | CC Commvault Cloud Commvault | 7.1 | Oct 13 | Hyperscale Path Traversal |
| CVE-2026-77106 | CC Commvault Cloud Commvault | 8.8 | Sep 8 | Cvlaunchd Code Execution |
| CVE-2026-77105 | CC Commvault Cloud Commvault | 8.8 | Sep 8 | CommServe Privilege Escalation |
| CVE-2026-77104 | CC Commvault Cloud Commvault | 7.5 | Sep 8 | CommServe Path Traversal |
| CVE-2026-77103 | CC Commvault Cloud Commvault | 7.5 | Sep 8 | CommServe Information Disclosure |
| CVE-2026-77102 | CC Commvault Cloud Commvault | 7.5 | Sep 8 | CommServe Denial of Service |
| CVE-2026-77101 | CC Commvault Cloud Commvault | 7.5 | Sep 8 | CommServe Stack-based Buffer Overflow |
| CVE-2026-77098 | CC Commvault Cloud Commvault | 9.8 | Sep 8 | Private Metrics Server SQL Injection |
| CVE-2026-77097 | CC Commvault Cloud Commvault | 8.2 | Sep 8 | Private Metrics Server Denial of Service |
| CVE-2026-77092 | CC Commvault Cloud Commvault | 9.8 | Sep 8 | Content Extractor Privilege Escalation |
| CVE-2026-77091 | CC Commvault Cloud Commvault | 7.8 | Sep 8 | DataCube Security Feature Bypass |
| CVE-2026-77089 | CC Commvault Cloud Commvault | 9.8 | Sep 8 | Command Center API Authentication Bypass |
| CVE-2026-13738 | CC Commvault Cloud Commvault | 9.8 | Aug 11 | Improper Authorization Validation |
| CVE-2026-13737 | CC Commvault Cloud Commvault | 9.8 | Aug 11 | Command Restriction Bypass |
| CVE-2026-13739 | CC Commvault Cloud Commvault | 9.8 | Aug 11 | Server-Side Request Forgery (SSRF) |
| CVE-2025-12776 | CO Commvault Commvault | 5.4 | Jan 7 | The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible Cross-Site… |
| CVE-2025-57791 | CO Commvault Commvault | 6.5 | Aug 20 | A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input… |
| CVE-2025-57790 | CO Commvault Commvault | 8.8 | Aug 20 | A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue |
| CVE-2025-57789 | CO Commvault Commvault | 5.4 | Aug 20 | During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control |
| CVE-2025-57788 | CO Commvault Commvault | 6.5 | Aug 20 | A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials |
| CVE-2025-3928 In wildKEV | WS Web Server Commvault | 8.8 | Apr 25 | Commvault Web Server unspecified vulnerability |
| CVE-2025-34028 In wildKEV | CC Command Center Innovation Release Commvault | 10.0 | Apr 22 | Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal |
| CVE-2021-34997 | CO Commcell Commvault | 8.8 | Jan 13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22 |
| CVE-2021-34996 | CO Commcell Commvault | 8.8 | Jan 13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22 |
| CVE-2021-34995 | CO Commcell Commvault | 8.8 | Jan 13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22 |
| CVE-2021-34994 | CO Commcell Commvault | 8.8 | Jan 13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22 |
| CVE-2021-34993 | CO Commcell Commvault | 9.8 | Jan 13 | This vulnerability allows remote attackers to bypass authentication on affected installations of Commvault CommCell 11.22.22 |
| CVE-2020-25780 | CO Commcell Commvault | 7.5 | Oct 29 | In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal can occur such that an attempt to view a… |
| CVE-2017-18044 | CO Commvault Commvault | 9.8 | Jan 19 | A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6 |
| CVE-2017-3195 | ED Edge Commvault | 9.8 | Dec 16 | Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to… |
| CVE-2015-7253 | ES Edge Server Commvault | – | Nov 4 | The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized data in a cookie |