EUVD-2026-56002

CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...

CVE-2026-13738

CVE-2026-13738 describes an authorization bypass in CommServe that affects a limited set of command execution operations. The vulnerability impacts a broad set of Commvault components (Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X) and is characterized by a high-sev...

CVE-2026-13737

The CVE-2026-13737 issue affects Commvault software (Commserve, Webserver, Command Center, Media Agents, Clients, HyperScale X) and is a command execution authorization allowlist bypass. Root cause: bypass of allowlists permits commands to run without proper authorization. Impact stated in the me...

EUVD-2026-56001

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X...

CVE-2025-57791 Argument Injection Vulnerability in CommServe

A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. Successful exploitation results in a valid user session for a low privilege role...

CVE-2025-57791 Argument Injection Vulnerability in CommServe

A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. Successful exploitation results in a valid user session for a low privilege role...

CVE-2025-34136

An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed...

CVE-2025-34136 Commvault CommServe Web Server Unauthenticated SQL Injection

An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed...