{"schema_version":1,"title":"Commvault vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 16 vulnerabilities in Commvault: 0 in the last 7 days and 14 in the last 90 days, 8 of them critical and 2 exploited in the wild. The most recent, CVE-2026-77106, was published on 8 September 2026. 2 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/commvault","json_url":"https://junglewise.ai/threats/vendors/commvault.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/commvault","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":8,"all_time":16,"critical":8,"exploited":2,"last_7_days":0,"last_30_days":11,"last_90_days":14,"last_365_days":14},"latest":[{"cve":"CVE-2026-77106","cvss":8.8,"epss":0.0058,"slug":"cve-2026-77106-commvault-cvlaunchd-missing-authorization-in-command-execution","title":"Commvault Cvlaunchd missing authorization in command execution","severity":"high","exploited":false,"published_at":"2026-09-08T13:17:26.517+00:00","url":"https://junglewise.ai/threats/cve-2026-77106-commvault-cvlaunchd-missing-authorization-in-command-execution"},{"cve":"CVE-2026-77105","cvss":8.8,"epss":0.003,"slug":"cve-2026-77105-commvault-commserve-cryptographic-signature-verification-in","title":"Commvault CommServe cryptographic signature verification in privilege management","severity":"high","exploited":false,"published_at":"2026-09-08T13:17:26.393+00:00","url":"https://junglewise.ai/threats/cve-2026-77105-commvault-commserve-cryptographic-signature-verification-in"},{"cve":"CVE-2026-77104","cvss":7.5,"epss":0.0056,"slug":"cve-2026-77104-commvault-commserve-path-traversal-information-disclosure","title":"Commvault CommServe path traversal information disclosure","severity":"high","exploited":false,"published_at":"2026-09-08T13:17:26.27+00:00","url":"https://junglewise.ai/threats/cve-2026-77104-commvault-commserve-path-traversal-information-disclosure"},{"cve":"CVE-2026-77103","cvss":7.5,"epss":0.005,"slug":"cve-2026-77103-commvault-commserve-authentication-bypass","title":"Commvault CommServe authentication bypass","severity":"high","exploited":false,"published_at":"2026-09-08T13:17:26.14+00:00","url":"https://junglewise.ai/threats/cve-2026-77103-commvault-commserve-authentication-bypass"},{"cve":"CVE-2026-77102","cvss":7.5,"epss":0.0046,"slug":"cve-2026-77102-commvault-commserve-heap-buffer-overflow","title":"Commvault CommServe heap buffer overflow","severity":"high","exploited":false,"published_at":"2026-09-08T13:17:25.987+00:00","url":"https://junglewise.ai/threats/cve-2026-77102-commvault-commserve-heap-buffer-overflow"},{"cve":"CVE-2026-77101","cvss":7.5,"epss":0.0046,"slug":"cve-2026-77101-commvault-commserve-stack-based-buffer-overflow","title":"Commvault CommServe stack-based buffer overflow","severity":"high","exploited":false,"published_at":"2026-09-08T13:17:25.86+00:00","url":"https://junglewise.ai/threats/cve-2026-77101-commvault-commserve-stack-based-buffer-overflow"},{"cve":"CVE-2026-77098","cvss":9.8,"epss":0.0047,"slug":"cve-2026-77098-commvault-private-metrics-server-sql-injection","title":"Commvault Private Metrics Server SQL injection","severity":"critical","exploited":false,"published_at":"2026-09-08T13:17:25.73+00:00","url":"https://junglewise.ai/threats/cve-2026-77098-commvault-private-metrics-server-sql-injection"},{"cve":"CVE-2026-77097","cvss":8.2,"epss":0.0047,"slug":"cve-2026-77097-commvault-private-metrics-server-authentication-bypass-in-metrics","title":"Commvault Private Metrics Server authentication bypass in metrics upload","severity":"high","exploited":false,"published_at":"2026-09-08T13:17:25.61+00:00","url":"https://junglewise.ai/threats/cve-2026-77097-commvault-private-metrics-server-authentication-bypass-in-metrics"},{"cve":"CVE-2026-77092","cvss":9.8,"epss":0.0032,"slug":"cve-2026-77092-commvault-content-extractor-deserialization-privilege-escalation","title":"Commvault Content Extractor deserialization privilege escalation","severity":"critical","exploited":false,"published_at":"2026-09-08T13:17:25.48+00:00","url":"https://junglewise.ai/threats/cve-2026-77092-commvault-content-extractor-deserialization-privilege-escalation"},{"cve":"CVE-2026-77091","cvss":7.8,"epss":0.0018,"slug":"cve-2026-77091-commvault-datacube-path-traversal-in-security-feature-enforcement","title":"Commvault DataCube path traversal in security feature enforcement","severity":"high","exploited":false,"published_at":"2026-09-08T13:17:25.357+00:00","url":"https://junglewise.ai/threats/cve-2026-77091-commvault-datacube-path-traversal-in-security-feature-enforcement"},{"cve":"CVE-2026-77089","cvss":9.8,"epss":0.0061,"slug":"cve-2026-77089-commvault-command-center-api-authentication-bypass","title":"Commvault Command Center API authentication bypass","severity":"critical","exploited":false,"published_at":"2026-09-08T13:17:25.227+00:00","url":"https://junglewise.ai/threats/cve-2026-77089-commvault-command-center-api-authentication-bypass"},{"cve":"CVE-2026-13739","cvss":9.8,"epss":0.0039,"slug":"cve-2026-13739-commvault-command-center-server-side-request-forgery-ssrf","title":"Commvault Command Center server-side request forgery (SSRF) unauthenticated","severity":"critical","exploited":false,"published_at":"2026-08-11T12:17:38.047+00:00","url":"https://junglewise.ai/threats/cve-2026-13739-commvault-command-center-server-side-request-forgery-ssrf"},{"cve":"CVE-2026-13738","cvss":9.8,"epss":0.0063,"slug":"cve-2026-13738-commvault-commserve-authorization-bypass-in-command-execution","title":"Commvault CommServe authorization bypass in command execution","severity":"critical","exploited":false,"published_at":"2026-08-11T12:17:37.923+00:00","url":"https://junglewise.ai/threats/cve-2026-13738-commvault-commserve-authorization-bypass-in-command-execution"},{"cve":"CVE-2026-13737","cvss":9.8,"epss":0.0052,"slug":"cve-2026-13737-commvault-commserve-allowlist-bypass-in-command-execution","title":"Commvault CommServe allowlist bypass in command execution authorization","severity":"critical","exploited":false,"published_at":"2026-08-11T12:17:37.18+00:00","url":"https://junglewise.ai/threats/cve-2026-13737-commvault-commserve-allowlist-bypass-in-command-execution"},{"cve":"CVE-2025-34028","cvss":10,"slug":"cve-2025-34028-commvault-command-center-path-traversal-vulnerability","title":"Commvault Command Center Path Traversal Vulnerability","severity":"critical","exploited":true,"published_at":"2025-05-02T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-34028-commvault-command-center-path-traversal-vulnerability"},{"cve":"CVE-2025-3928","cvss":8.8,"slug":"cve-2025-3928-commvault-web-server-unspecified-vulnerability","title":"Commvault Web Server Unspecified Vulnerability","severity":"critical","exploited":true,"published_at":"2025-04-28T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-3928-commvault-web-server-unspecified-vulnerability"}],"vendor":{"hub":true,"name":"Commvault","slug":"commvault","homepage":"https://www.commvault.com/","description":"A data management software company that provides backup, recovery, and archiving solutions.","url":"https://junglewise.ai/threats/vendors/commvault"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":3,"exploited":0,"vulnerabilities":3},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":3,"exploited":0,"vulnerabilities":11},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2025-34028","cvss":10,"slug":"cve-2025-34028-commvault-command-center-path-traversal-vulnerability","title":"Commvault Command Center Path Traversal Vulnerability","severity":"critical","exploited":true,"published_at":"2025-05-02T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-34028-commvault-command-center-path-traversal-vulnerability"},{"cve":"CVE-2025-3928","cvss":8.8,"slug":"cve-2025-3928-commvault-web-server-unspecified-vulnerability","title":"Commvault Web Server Unspecified Vulnerability","severity":"critical","exploited":true,"published_at":"2025-04-28T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2025-3928-commvault-web-server-unspecified-vulnerability"},{"cve":"CVE-2026-13738","cvss":9.8,"epss":0.0063,"slug":"cve-2026-13738-commvault-commserve-authorization-bypass-in-command-execution","title":"Commvault CommServe authorization bypass in command execution","severity":"critical","exploited":false,"published_at":"2026-08-11T12:17:37.923+00:00","url":"https://junglewise.ai/threats/cve-2026-13738-commvault-commserve-authorization-bypass-in-command-execution"},{"cve":"CVE-2026-77089","cvss":9.8,"epss":0.0061,"slug":"cve-2026-77089-commvault-command-center-api-authentication-bypass","title":"Commvault Command Center API authentication bypass","severity":"critical","exploited":false,"published_at":"2026-09-08T13:17:25.227+00:00","url":"https://junglewise.ai/threats/cve-2026-77089-commvault-command-center-api-authentication-bypass"},{"cve":"CVE-2026-13737","cvss":9.8,"epss":0.0052,"slug":"cve-2026-13737-commvault-commserve-allowlist-bypass-in-command-execution","title":"Commvault CommServe allowlist bypass in command execution authorization","severity":"critical","exploited":false,"published_at":"2026-08-11T12:17:37.18+00:00","url":"https://junglewise.ai/threats/cve-2026-13737-commvault-commserve-allowlist-bypass-in-command-execution"},{"cve":"CVE-2026-77098","cvss":9.8,"epss":0.0047,"slug":"cve-2026-77098-commvault-private-metrics-server-sql-injection","title":"Commvault Private Metrics Server SQL injection","severity":"critical","exploited":false,"published_at":"2026-09-08T13:17:25.73+00:00","url":"https://junglewise.ai/threats/cve-2026-77098-commvault-private-metrics-server-sql-injection"},{"cve":"CVE-2026-13739","cvss":9.8,"epss":0.0039,"slug":"cve-2026-13739-commvault-command-center-server-side-request-forgery-ssrf","title":"Commvault Command Center server-side request forgery (SSRF) unauthenticated","severity":"critical","exploited":false,"published_at":"2026-08-11T12:17:38.047+00:00","url":"https://junglewise.ai/threats/cve-2026-13739-commvault-command-center-server-side-request-forgery-ssrf"},{"cve":"CVE-2026-77092","cvss":9.8,"epss":0.0032,"slug":"cve-2026-77092-commvault-content-extractor-deserialization-privilege-escalation","title":"Commvault Content Extractor deserialization privilege escalation","severity":"critical","exploited":false,"published_at":"2026-09-08T13:17:25.48+00:00","url":"https://junglewise.ai/threats/cve-2026-77092-commvault-content-extractor-deserialization-privilege-escalation"},{"cve":"CVE-2026-77106","cvss":8.8,"epss":0.0058,"slug":"cve-2026-77106-commvault-cvlaunchd-missing-authorization-in-command-execution","title":"Commvault Cvlaunchd missing authorization in command execution","severity":"high","exploited":false,"published_at":"2026-09-08T13:17:26.517+00:00","url":"https://junglewise.ai/threats/cve-2026-77106-commvault-cvlaunchd-missing-authorization-in-command-execution"},{"cve":"CVE-2026-77105","cvss":8.8,"epss":0.003,"slug":"cve-2026-77105-commvault-commserve-cryptographic-signature-verification-in","title":"Commvault CommServe cryptographic signature verification in privilege management","severity":"high","exploited":false,"published_at":"2026-09-08T13:17:26.393+00:00","url":"https://junglewise.ai/threats/cve-2026-77105-commvault-commserve-cryptographic-signature-verification-in"}],"generated_at":"2026-09-26T09:11:00.170868+00:00","technologies":[{"name":"Commvault CommServe","slug":"commserve","vulnerabilities":7,"url":"https://junglewise.ai/threats/technologies/commserve"},{"name":"Commvault Command Center","slug":"command-center","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/command-center"}]}