CVE-2026-77106CWE-862broken-access-control

CVE-2026-77106

High · published September 8, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
46.9
In the wild
Unconfirmed
What it is

Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.7 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00580 · 46.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-08T17:17Z
Affected products (4)
ProductVersionsFixed in
commvault/commvault≥ 11.36.0, < 11.36.12311.36.123
commvault/commvault≥ 11.40.0, < 11.40.7211.40.72
commvault/commvault≥ 11.44.0, < 11.44.2011.44.20
commvault/commvault≥ 11.46.0, < 11.46.2011.46.20
References (1)
https://documentation.commvault.com/securityadvisories/CV_2026_08_8.html · 050066fd-a2f9-4f32-ab5d-4c53f48bc333
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 12:12Z
    Cvlaunchd Code Execution
    cvelistv5