by Kastro
Paper/Archive/CVE-2026-77098

CVE-2026-77098

Commvault Commvault Cloud — Private Metrics Server SQL Injection

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 40.5.405 × 208.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

Affected

ProductAffectedFixed inSource
Commvault Cloud11.46.0 – 11.46.19–CNA
Commvault Cloud11.44.0 – 11.44.19–CNA
Commvault Cloud11.40.0 – 11.40.71–CNA
Commvault Cloud11.36.0 – 11.36.122–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Commvault (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refdocumentation.commvault.com/securityadvisories/CV_2026_08_2.html