Commvault Cloud vulnerabilities

10 CVEs affecting Commvault Cloud, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97334, published 2026-10-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-77099, published 2026-10-13. Critical severity, CVSS 9.3. EPSS: 0.4% chance of exploitation in the next 30 days. CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
CVE-2026-18228, published 2026-10-13. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents.
CVE-2026-97334, published 2026-10-13. High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days. The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault…
CVE-2026-77090, published 2026-10-13. High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days. CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.
CVE-2026-77100, published 2026-10-13. High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days. MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update Commvault installation of MediaAgents and…
CVE-2026-97333, published 2026-10-13. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe, Web Server, Command Center and Index Server.
CVE-2026-77096, published 2026-10-13. High severity, CVSS 7.7. EPSS: 0.2% chance of exploitation in the next 30 days. CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.
CVE-2026-77095, published 2026-10-13. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe,…
CVE-2026-77094, published 2026-10-13. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update…
CVE-2026-77093, published 2026-10-13. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver,…