CVE-2026-77090: Commvault Cloud

High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days.

CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.

Affected products

• Commvault Commvault Cloud: from 11.46.0, up to and including 11.46.29; from 11.44.0, up to and including 11.44.24; from 11.40.0, up to and including 11.40.77; from 11.36.0, up to and including 11.36.126
• Commvault Gridhsx Cvfs: from 5.0.1.0, up to and including 5.0.14.4

Published 2026-10-13. Last modified 2026-10-14.