by Kastro
Paper/Archive/CVE-2026-13737

CVE-2026-13737

Commvault Commvault Cloud — Command Restriction Bypass

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.9.519 × 2010.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

Affected

ProductAffectedFixed inSource
Commvault Cloud11.46.0 – 11.46.9–CNA
Commvault Cloud11.44.0 – 11.44.10–CNA
Commvault Cloud11.40.0 – 11.40.62–CNA
Commvault Cloud11.36.0 – 11.36.113–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Commvault (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdocumentation.commvault.com/securityadvisories/CV_2026_07_8.html