CVE-2026-13737criticalCWE-863

CVE-2026-13737: critical vulnerability in Commvault Cloud

Command Restriction Bypass

Published

Follow this CVE+ Monitor Commvault Cloud

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.2epss 0.7%
CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Commvault · Commvault Cloud
Related CVEs — Commvault Cloud

In the same product, most dangerous first.

CVE-2026-13738CRITICALImproper Authorization ValidationEPSS 0.7%CVE-2026-77089CRITICALCommand Center API Authentication BypassEPSS 0.6%CVE-2026-77106HIGHCvlaunchd Code ExecutionEPSS 0.6%CVE-2026-77104HIGHCommServe Path TraversalEPSS 0.6%CVE-2026-77103HIGHCommServe Information DisclosureEPSS 0.5%CVE-2026-13739HIGHServer-Side Request Forgery (SSRF)EPSS 0.5%