by Kastro
Paper/Archive/CVE-2026-13738

CVE-2026-13738

Commvault Commvault Cloud — Improper Authorization Validation

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.9.519 × 2010.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

Affected

ProductAffectedFixed inSource
Commvault Cloud11.46.0 – 11.46.9–CNA
Commvault Cloud11.44.0 – 11.44.10–CNA
Commvault Cloud11.40.0 – 11.40.62–CNA
Commvault Cloud11.36.0 – 11.36.113–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Commvault (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdocumentation.commvault.com/securityadvisories/CV_2026_07_9.html