CVE-2026-77092: Commvault

Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.

Affected products

• Commvault Commvault: from 11.36.0, before 11.36.123 (fixed in 11.36.123); from 11.40.0, before 11.40.72 (fixed in 11.40.72); from 11.44.0, before 11.44.20 (fixed in 11.44.20); from 11.46.0, before 11.46.20 (fixed in 11.46.20)

Published 2026-09-08. Last modified 2026-09-11.