CVE-2026-13737CWE-863broken-access-control

CVE-2026-13737

Critical · published August 11, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
43.5
In the wild
Unconfirmed
What it is

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00522 · 43.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-11T16:17Z
Affected products (4)
ProductVersionsFixed in
commvault/commvault≥ 11.36.0, < 11.36.11411.36.114
commvault/commvault≥ 11.40.0, < 11.40.6311.40.63
commvault/commvault≥ 11.44.0, < 11.44.1111.44.11
commvault/commvault≥ 11.46.0, < 11.46.1011.46.10
References (1)
https://documentation.commvault.com/securityadvisories/CV_2026_07_8.html · 050066fd-a2f9-4f32-ab5d-4c53f48bc333
EPSS history
Timeline
  • 11 AUG 11:01Z
    Command Restriction Bypass
    cvelistv5