CVE-2026-13738CWE-863broken-access-control

CVE-2026-13738

Critical · published August 11, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
49.4
In the wild
Unconfirmed
What it is

CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00628 · 49.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-11T16:17Z
Affected products (4)
ProductVersionsFixed in
commvault/commvault≥ 11.36.0, < 11.36.11411.36.114
commvault/commvault≥ 11.40.0, < 11.40.6311.40.63
commvault/commvault≥ 11.44.0, < 11.44.1111.44.11
commvault/commvault≥ 11.46.0, < 11.46.1011.46.10
References (1)
https://documentation.commvault.com/securityadvisories/CV_2026_07_9.html · 050066fd-a2f9-4f32-ab5d-4c53f48bc333
EPSS history
Timeline
  • 11 AUG 11:01Z
    Improper Authorization Validation
    cvelistv5