# Commvault vulnerabilities Source: https://junglewise.ai/threats/vendors/commvault Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/commvault.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 26 vulnerabilities in Commvault: 0 in the last 7 days and 21 in the last 90 days, 8 of them critical and 2 exploited in the wild. The most recent, CVE-2026-97334, was published on 13 October 2026. 10 vulnerabilities in the last four weeks, up from none in the four before. 3 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 21 - All time: 26 (8 critical, 2 exploited in the wild) ## About Commvault Commvault is a software company providing data protection and information management solutions. ## Latest Commvault vulnerabilities - [CVE-2026-97334: Commvault network messaging layer decompression resource exhaustion](https://junglewise.ai/threats/cve-2026-97334-the-network-messaging-layer-contained-improper-handling-of-highly) (info, published 13 Oct 2026) - [CVE-2026-97333: Commvault QAPI stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-97333-qapi-contained-a-stack-based-buffer-overflow-affecting-service) (info, published 13 Oct 2026) - [CVE-2026-77100: Commvault MediaAgent heap buffer overflow denial of service](https://junglewise.ai/threats/cve-2026-77100-mediaagent-contained-a-heap-based-buffer-overflow-issue-affecting) (info, published 13 Oct 2026) - [CVE-2026-77099: Commvault CVFS input validation issue in command execution](https://junglewise.ai/threats/cve-2026-77099-cvfs-contained-an-input-validation-issue-affecting-command) (info, published 13 Oct 2026) - [CVE-2026-77096: Commvault CVFS missing authentication in command execution](https://junglewise.ai/threats/cve-2026-77096-cvfs-contained-a-missing-authentication-condition-affecting) (info, published 13 Oct 2026) - [CVE-2026-77095: Commvault null pointer dereference in CvFWD](https://junglewise.ai/threats/cve-2026-77095-cvfwd-contained-a-null-pointer-dereference-affecting-service) (info, published 13 Oct 2026) - [CVE-2026-77094: Commvault CvFWD out-of-bounds write denial of service](https://junglewise.ai/threats/cve-2026-77094-cvfwd-contained-an-out-of-bounds-write-affecting-service) (info, published 13 Oct 2026) - [CVE-2026-77093: Commvault CvFWD integer overflow denial of service](https://junglewise.ai/threats/cve-2026-77093-cvfwd-contained-an-integer-overflow-affecting-service) (info, published 13 Oct 2026) - [CVE-2026-77090: Commvault CVFS XML external entity injection information disclosure](https://junglewise.ai/threats/cve-2026-77090-cvfs-contained-an-xml-external-entity-xxe-reference-handling) (info, published 13 Oct 2026) - [CVE-2026-18228: Commvault HyperScale path traversal in information disclosure](https://junglewise.ai/threats/cve-2026-18228-hyperscale-contained-a-path-traversal-issue-affecting-information) (info, published 13 Oct 2026) - [CVE-2026-77106: Commvault Cvlaunchd missing authorization in command execution](https://junglewise.ai/threats/cve-2026-77106-commvault-cvlaunchd-missing-authorization-in-command-execution) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-77105: Commvault CommServe cryptographic signature verification in privilege management](https://junglewise.ai/threats/cve-2026-77105-commvault-commserve-cryptographic-signature-verification-in) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-77104: Commvault CommServe path traversal information disclosure](https://junglewise.ai/threats/cve-2026-77104-commvault-commserve-path-traversal-information-disclosure) (high, CVSS 7.5, published 8 Sep 2026) - [CVE-2026-77103: Commvault CommServe authentication bypass](https://junglewise.ai/threats/cve-2026-77103-commvault-commserve-authentication-bypass) (high, CVSS 7.5, published 8 Sep 2026) - [CVE-2026-77102: Commvault CommServe heap buffer overflow](https://junglewise.ai/threats/cve-2026-77102-commvault-commserve-heap-buffer-overflow) (high, CVSS 7.5, published 8 Sep 2026) - [CVE-2026-77101: Commvault CommServe stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-77101-commvault-commserve-stack-based-buffer-overflow) (high, CVSS 7.5, published 8 Sep 2026) - [CVE-2026-77098: Commvault Private Metrics Server SQL injection](https://junglewise.ai/threats/cve-2026-77098-commvault-private-metrics-server-sql-injection) (critical, CVSS 9.8, published 8 Sep 2026) - [CVE-2026-77097: Commvault Private Metrics Server authentication bypass in metrics upload](https://junglewise.ai/threats/cve-2026-77097-commvault-private-metrics-server-authentication-bypass-in-metrics) (high, CVSS 8.2, published 8 Sep 2026) - [CVE-2026-77092: Commvault Content Extractor deserialization privilege escalation](https://junglewise.ai/threats/cve-2026-77092-commvault-content-extractor-deserialization-privilege-escalation) (critical, CVSS 9.8, published 8 Sep 2026) - [CVE-2026-77091: Commvault DataCube path traversal in security feature enforcement](https://junglewise.ai/threats/cve-2026-77091-commvault-datacube-path-traversal-in-security-feature-enforcement) (high, CVSS 7.8, published 8 Sep 2026) - [CVE-2026-77089: Commvault Command Center API authentication bypass](https://junglewise.ai/threats/cve-2026-77089-commvault-command-center-api-authentication-bypass) (critical, CVSS 9.8, published 8 Sep 2026) - [CVE-2026-13739: Commvault Command Center server-side request forgery (SSRF) unauthenticated](https://junglewise.ai/threats/cve-2026-13739-commvault-command-center-server-side-request-forgery-ssrf) (critical, CVSS 9.8, published 11 Aug 2026) - [CVE-2026-13738: Commvault CommServe authorization bypass in command execution](https://junglewise.ai/threats/cve-2026-13738-commvault-commserve-authorization-bypass-in-command-execution) (critical, CVSS 9.8, published 11 Aug 2026) - [CVE-2026-13737: Commvault CommServe allowlist bypass in command execution authorization](https://junglewise.ai/threats/cve-2026-13737-commvault-commserve-allowlist-bypass-in-command-execution) (critical, CVSS 9.8, published 11 Aug 2026) - [CVE-2025-34028: Commvault Command Center Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2025-34028-commvault-command-center-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 10, published 2 May 2025) ## Most severe Commvault vulnerabilities - [CVE-2025-34028: Commvault Command Center Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2025-34028-commvault-command-center-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 10, published 2 May 2025) - [CVE-2025-3928: Commvault Web Server Unspecified Vulnerability](https://junglewise.ai/threats/cve-2025-3928-commvault-web-server-unspecified-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 28 Apr 2025) - [CVE-2026-13738: Commvault CommServe authorization bypass in command execution](https://junglewise.ai/threats/cve-2026-13738-commvault-commserve-authorization-bypass-in-command-execution) (critical, CVSS 9.8, published 11 Aug 2026) - [CVE-2026-77089: Commvault Command Center API authentication bypass](https://junglewise.ai/threats/cve-2026-77089-commvault-command-center-api-authentication-bypass) (critical, CVSS 9.8, published 8 Sep 2026) - [CVE-2026-13737: Commvault CommServe allowlist bypass in command execution authorization](https://junglewise.ai/threats/cve-2026-13737-commvault-commserve-allowlist-bypass-in-command-execution) (critical, CVSS 9.8, published 11 Aug 2026) - [CVE-2026-77098: Commvault Private Metrics Server SQL injection](https://junglewise.ai/threats/cve-2026-77098-commvault-private-metrics-server-sql-injection) (critical, CVSS 9.8, published 8 Sep 2026) - [CVE-2026-13739: Commvault Command Center server-side request forgery (SSRF) unauthenticated](https://junglewise.ai/threats/cve-2026-13739-commvault-command-center-server-side-request-forgery-ssrf) (critical, CVSS 9.8, published 11 Aug 2026) - [CVE-2026-77092: Commvault Content Extractor deserialization privilege escalation](https://junglewise.ai/threats/cve-2026-77092-commvault-content-extractor-deserialization-privilege-escalation) (critical, CVSS 9.8, published 8 Sep 2026) - [CVE-2026-77106: Commvault Cvlaunchd missing authorization in command execution](https://junglewise.ai/threats/cve-2026-77106-commvault-cvlaunchd-missing-authorization-in-command-execution) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-77105: Commvault CommServe cryptographic signature verification in privilege management](https://junglewise.ai/threats/cve-2026-77105-commvault-commserve-cryptographic-signature-verification-in) (high, CVSS 8.8, published 8 Sep 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 11 | 3 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 10 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Commvault technologies - [Commvault](https://junglewise.ai/threats/technologies/commvault): 9 vulnerabilities - [Commvault CommServe](https://junglewise.ai/threats/technologies/commserve): 7 vulnerabilities - [Commvault Command Center](https://junglewise.ai/threats/technologies/command-center): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Commvault vulnerabilities", https://junglewise.ai/threats/vendors/commvault, 13 November 2026.