CVE-2026-97334CWE-409

CVE-2026-97334

published October 13, 2026

CVSS
8.7
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00356 · 28.1th percentile
Weakness
CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification)
Published
2026-10-13T19:17Z
References (1)
https://documentation.commvault.com/securityadvisories/CV_2026_10_3.html · 050066fd-a2f9-4f32-ab5d-4c53f48bc333
EPSS history
Timeline
  • 15 OCT 03:35Z
    EPSS moved — → 0%
    epss
  • 13 OCT 14:27Z
    Network messaging layer decompression resource exhaustion
    cvelistv5
  • 13 OCT 14:27Z
    Network messaging layer decompression resource exhaustion
    cvelistv5