Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

Commvault Cloud allows unauthorized command execution

CVE-2026-13738 · published 2 months ago
Summary

The CommServe component in Commvault Cloud can be tricked into running certain commands without proper permission checks. This could let an attacker perform limited actions on the system. Upgrade all Commvault components to the latest maintenance release to close the gap.

What to do
  • Update commvault commvault cloud to version 11.46.10.
Affected software
VendorProductAffected versions
commvault commvault cloud <= 11.46.9
Fix: upgrade to 11.46.10
commvault commvault >= 11.36.0, < 11.36.114
>= 11.40.0, < 11.40.63
>= 11.44.0, < 11.44.11
>= 11.46.0, < 11.46.10
cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*
Original advisory text
CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault...
CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.2 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published11 Aug 2026
Updated4 Nov 2026
First seen11 Aug 2026
Sources
CVE-2026-13738 · NVD
CVE-2026-13738 · MITRE
Track software like this
Free during beta