# CVE-2026-77090: Commvault CVFS XML external entity injection information disclosure

Source: https://junglewise.ai/threats/cve-2026-77090-cvfs-contained-an-xml-external-entity-xxe-reference-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-77090 · Severity: info · Published 2026-10-13

Commvault's CVFS (Cloud Volumes for Scale), a storage virtualization component, contains an XML external entity (XXE) vulnerability that allows attackers to disclose sensitive information. An attacker with network access to CVFS can read arbitrary files or configuration data through malicious XML payloads, potentially exposing credentials, configurations, or other confidential data stored on backup and storage systems.

Vendors: [Commvault](https://junglewise.ai/threats/vendors/commvault).

## Quick answers

**Is CVE-2026-77090 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77090 being exploited in the wild.

**How severe is CVE-2026-77090?** Informational severity, published 13 October 2026.

**Which products and versions are affected?** Commvault Linux 11.36.0–11.36.126, 11.40.0–11.40.77, 11.44.0–11.44.24, 11.46.0–11.46.29; Commvault CVFS 5.0.1.0 to 5.0.14.4.

**Is there a fix for CVE-2026-77090?** Yes: fixed in CVFS 5.0.14.5 and higher; Commvault Linux 11.36.127 and higher, 11.40.78 and higher, 11.44.25 and higher, 11.46.30 and higher. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77090 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-77090?** Check whether you run Commvault Linux or Commvault CVFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in CVFS 5.0.14.5 and higher; Commvault Linux 11.36.127 and higher, 11.40.78 and higher, 11.44.25 and higher, 11.46.30 and higher

## Technical details

The vulnerability is an XXE injection in CVFS's XML parsing logic affecting versions 5.0.1.0 through 5.0.14.4 (Grid/HSX), and Commvault Linux versions 11.36.0–11.36.126, 11.40.0–11.40.77, 11.44.0–11.44.24, and 11.46.0–11.46.29. An attacker can supply crafted XML input to trigger external entity resolution, leading to information disclosure. Network-level access to CVFS is required; no authentication bypass or code execution is indicated.

## Affected products

- Commvault CVFS 5.0.1.0 to 5.0.14.4
- Commvault Commvault Linux 11.36.0–11.36.126, 11.40.0–11.40.77, 11.44.0–11.44.24, 11.46.0–11.46.29

## Timeline

- 2026-10-13: disclosed

## References

- [https://documentation.commvault.com/securityadvisories/CV_2026_07_4.html](https://documentation.commvault.com/securityadvisories/CV_2026_07_4.html)

## Related threats

- [Commvault CVFS missing authentication in command execution](https://junglewise.ai/threats/cve-2026-77096-cvfs-contained-a-missing-authentication-condition-affecting)