CVE-2026-77103CWE-288

CVE-2026-77103

High · published September 8, 2026

CVSS v3.1

7.5

EPSS

Percentile

41.7

In the wild

Unconfirmed

What it is

CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00497 · 41.7th percentile
Weakness: CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published: 2026-09-08T17:17Z

Affected products (4)

Product	Versions	Fixed in
commvault/commvault	≥ 11.36.0, < 11.36.123	11.36.123
commvault/commvault	≥ 11.40.0, < 11.40.72	11.40.72
commvault/commvault	≥ 11.44.0, < 11.44.20	11.44.20
commvault/commvault	≥ 11.46.0, < 11.46.20	11.46.20

References (1)

https://documentation.commvault.com/securityadvisories/CV_2026_08_5.html · 050066fd-a2f9-4f32-ab5d-4c53f48bc333

EPSS history

Timeline

10 SEP 03:18Z
EPSS moved — → 0%
epss
08 SEP 12:12Z
CommServe Information Disclosure
cvelistv5