# Commvault vulnerabilities Source: https://junglewise.ai/threats/technologies/commvault Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/commvault.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 9 vulnerabilities in Commvault: 0 in the last 7 days and 9 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-97334, was published on 13 October 2026. 7 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 9 - All time: 9 (0 critical, 0 exploited in the wild) ## About Commvault Data protection and management platform providing backup, recovery, and data governance capabilities. ## Latest Commvault vulnerabilities - [CVE-2026-97334: Commvault network messaging layer decompression resource exhaustion](https://junglewise.ai/threats/cve-2026-97334-the-network-messaging-layer-contained-improper-handling-of-highly) (info, published 13 Oct 2026) - [CVE-2026-97333: Commvault QAPI stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-97333-qapi-contained-a-stack-based-buffer-overflow-affecting-service) (info, published 13 Oct 2026) - [CVE-2026-77096: Commvault CVFS missing authentication in command execution](https://junglewise.ai/threats/cve-2026-77096-cvfs-contained-a-missing-authentication-condition-affecting) (info, published 13 Oct 2026) - [CVE-2026-77095: Commvault null pointer dereference in CvFWD](https://junglewise.ai/threats/cve-2026-77095-cvfwd-contained-a-null-pointer-dereference-affecting-service) (info, published 13 Oct 2026) - [CVE-2026-77094: Commvault CvFWD out-of-bounds write denial of service](https://junglewise.ai/threats/cve-2026-77094-cvfwd-contained-an-out-of-bounds-write-affecting-service) (info, published 13 Oct 2026) - [CVE-2026-77093: Commvault CvFWD integer overflow denial of service](https://junglewise.ai/threats/cve-2026-77093-cvfwd-contained-an-integer-overflow-affecting-service) (info, published 13 Oct 2026) - [CVE-2026-18228: Commvault HyperScale path traversal in information disclosure](https://junglewise.ai/threats/cve-2026-18228-hyperscale-contained-a-path-traversal-issue-affecting-information) (info, published 13 Oct 2026) - [CVE-2026-77106: Commvault Cvlaunchd missing authorization in command execution](https://junglewise.ai/threats/cve-2026-77106-commvault-cvlaunchd-missing-authorization-in-command-execution) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-77097: Commvault Private Metrics Server authentication bypass in metrics upload](https://junglewise.ai/threats/cve-2026-77097-commvault-private-metrics-server-authentication-bypass-in-metrics) (high, CVSS 8.2, published 8 Sep 2026) ## Most severe Commvault vulnerabilities - [CVE-2026-77106: Commvault Cvlaunchd missing authorization in command execution](https://junglewise.ai/threats/cve-2026-77106-commvault-cvlaunchd-missing-authorization-in-command-execution) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-77097: Commvault Private Metrics Server authentication bypass in metrics upload](https://junglewise.ai/threats/cve-2026-77097-commvault-private-metrics-server-authentication-bypass-in-metrics) (high, CVSS 8.2, published 8 Sep 2026) - [CVE-2026-18228: Commvault HyperScale path traversal in information disclosure](https://junglewise.ai/threats/cve-2026-18228-hyperscale-contained-a-path-traversal-issue-affecting-information) (info, published 13 Oct 2026) - [CVE-2026-97334: Commvault network messaging layer decompression resource exhaustion](https://junglewise.ai/threats/cve-2026-97334-the-network-messaging-layer-contained-improper-handling-of-highly) (info, published 13 Oct 2026) - [CVE-2026-97333: Commvault QAPI stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-97333-qapi-contained-a-stack-based-buffer-overflow-affecting-service) (info, published 13 Oct 2026) - [CVE-2026-77096: Commvault CVFS missing authentication in command execution](https://junglewise.ai/threats/cve-2026-77096-cvfs-contained-a-missing-authentication-condition-affecting) (info, published 13 Oct 2026) - [CVE-2026-77095: Commvault null pointer dereference in CvFWD](https://junglewise.ai/threats/cve-2026-77095-cvfwd-contained-a-null-pointer-dereference-affecting-service) (info, published 13 Oct 2026) - [CVE-2026-77094: Commvault CvFWD out-of-bounds write denial of service](https://junglewise.ai/threats/cve-2026-77094-cvfwd-contained-an-out-of-bounds-write-affecting-service) (info, published 13 Oct 2026) - [CVE-2026-77093: Commvault CvFWD integer overflow denial of service](https://junglewise.ai/threats/cve-2026-77093-cvfwd-contained-an-integer-overflow-affecting-service) (info, published 13 Oct 2026) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 2 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 7 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Commvault technologies - [Commvault CommServe](https://junglewise.ai/threats/technologies/commserve): 7 vulnerabilities - [Commvault Command Center](https://junglewise.ai/threats/technologies/command-center): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Commvault vulnerabilities", https://junglewise.ai/threats/technologies/commvault, 13 November 2026.