# CVE-2026-44926: Veritas InfoScale CmdServer improper access control

Source: https://junglewise.ai/threats/cve-2026-44926-veritas-infoscale-cmdserver-improper-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-44926 · Severity: info · Published 2026-05-20

Veritas InfoScale CmdServer, a component used for managing enterprise storage and clusters, contains a security flaw in how it handles access permissions. This vulnerability could allow unauthorized individuals to bypass security checks and potentially execute commands or access sensitive management functions. Such an exploit could lead to unauthorized changes to storage infrastructure or disruption of business-critical services.

Vendors: [Veritas](https://junglewise.ai/threats/vendors/veritas).

## Quick answers

**Is CVE-2026-44926 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44926 being exploited in the wild.

**How severe is CVE-2026-44926?** Informational severity, published 20 May 2026.

**Which products and versions are affected?** Veritas InfoScale CmdServer before 7.4.2.

**Is there a fix for CVE-2026-44926?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44926 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44926?** Check whether you run Veritas InfoScale CmdServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Veritas InfoScale CmdServer versions prior to 7.4.2 contain an access control vulnerability. The CmdServer component, which facilitates remote management and command execution across InfoScale clusters, fails to properly validate or enforce authorization checks. An attacker with network access to the CmdServer service could exploit this flaw to perform unauthorized actions. While specific exploitation details are limited, the vulnerability typically involves bypassing authentication or authorization logic to execute administrative commands. Users are advised to upgrade to InfoScale 7.4.2 or later to remediate this issue.

## Affected products

- Veritas InfoScale CmdServer before 7.4.2

## Timeline

- 2026-05-20: disclosed: Initial NVD publication date

## References

- [https://supportinfoscale.cloud.com/support-home/kbsearch/article?articleNumber=1000766081&articleTitle=InfoScale_Command_Server_Security_Bulletin_for_CVE_2026_44926](https://supportinfoscale.cloud.com/support-home/kbsearch/article?articleNumber=1000766081&articleTitle=InfoScale_Command_Server_Security_Bulletin_for_CVE_2026_44926)
- [https://www.veritas.com/support/en_US/doc/109864724-141543588-0/v141217547-141543588](https://www.veritas.com/support/en_US/doc/109864724-141543588-0/v141217547-141543588)