CVE-2026-97334highCWE-409

CVE-2026-97334: high-severity vulnerability in Commvault Cloud

Network messaging layer decompression resource exhaustion

Published

Follow this CVE+ Monitor Commvault Cloud

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.4%
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
Commvault · Commvault Cloud
Related CVEs — Commvault Cloud

In the same product, most dangerous first.

CVE-2026-13738CRITICALImproper Authorization ValidationEPSS 0.7%CVE-2026-13737CRITICALCommand Restriction BypassEPSS 0.7%CVE-2026-77089CRITICALCommand Center API Authentication BypassEPSS 0.6%CVE-2026-77106HIGHCvlaunchd Code ExecutionEPSS 0.6%CVE-2026-77104HIGHCommServe Path TraversalEPSS 0.6%CVE-2026-77103HIGHCommServe Information DisclosureEPSS 0.5%