Is CVE-2026-77099 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77099 being exploited in the wild.

How severe is CVE-2026-77099?

Informational severity, published 13 October 2026.

Which products and versions are affected?

Commvault Cloud 11.36.0–11.46.29; Commvault HyperScale X CVFS 5.0.1.0–5.0.14.4.

How is CVE-2026-77099 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-77099?

Check whether you run Commvault Cloud or Commvault HyperScale X CVFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77099: Commvault CVFS input validation issue in command execution

CVE-2026-77099 · Severity: info · Published 2026-10-13

Commvault File System (CVFS) is a component used in Commvault backup and recovery software to manage storage. An input validation flaw allows remote attackers to execute arbitrary commands, potentially compromising backup infrastructure and enabling data access or destruction. This affects multiple supported versions across Commvault Cloud and HyperScale X platforms.

Vendors: Commvault.

Quick answers

Is CVE-2026-77099 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77099 being exploited in the wild.
How severe is CVE-2026-77099?: Informational severity, published 13 October 2026.
Which products and versions are affected?: Commvault Cloud 11.36.0–11.46.29; Commvault HyperScale X CVFS 5.0.1.0–5.0.14.4.
Is there a fix for CVE-2026-77099?: Yes: fixed in Commvault Cloud: 11.36.127 and higher, 11.40.78 and higher, 11.44.25 and higher, 11.46.30 and higher; HyperScale X CVFS: 5.0.14.5 and higher. Until then: Verify updates are installed via Command Center (Manage > Servers for Commvault Cloud versions 11.44+, or Manage > Storage > HyperScale X for pool nodes). For versions 11.40 and below, use the HSX shell command `/usr/local/hedvig/scripts/whichCommit.sh` to confirm CVFS version is at the resolved level across all nodes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77099 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-77099?: Check whether you run Commvault Cloud or Commvault HyperScale X CVFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Commvault Cloud: 11.36.127 and higher, 11.40.78 and higher, 11.44.25 and higher, 11.46.30 and higher; HyperScale X CVFS: 5.0.14.5 and higher

Verify updates are installed via Command Center (Manage > Servers for Commvault Cloud versions 11.44+, or Manage > Storage > HyperScale X for pool nodes). For versions 11.40 and below, use the HSX shell command `/usr/local/hedvig/scripts/whichCommit.sh` to confirm CVFS version is at the resolved level across all nodes.

Technical details

The vulnerability is an input validation issue in CVFS that leads to command execution. The flaw affects Commvault Linux versions 11.36–11.46 and HyperScale X CVFS 5.0.1.0–5.0.14.4. Exploitation requires network access to the CVFS component; fixes are available in specific maintenance releases for each affected version line.

Affected products

Commvault Commvault Cloud 11.36.0–11.46.29
Commvault HyperScale X CVFS 5.0.1.0–5.0.14.4

Timeline

2026-10-13: disclosed

References

https://documentation.commvault.com/securityadvisories/CV_2026_10_9.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.