CVE-2026-13737
Full vulnerability record from the local CVENow database.
Description
CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
Severity
CRITICAL
CVSS score
9.2
(v4.0)
Vulnerability status
Analyzed
Source identifier
050066fd-a2f9-4f32-ab5d-4c53f48bc333
Published
2026-08-11 12:17:37.180000
Last modified
2026-10-23 19:10:00.167000
View original CVE JSON
{
"id": "CVE-2026-13737",
"sourceIdentifier": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"published": "2026-08-11T12:17:37.180",
"lastModified": "2026-10-23T19:10:00.167",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X."
},
{
"lang": "es",
"value": "CommServe contenía una vulnerabilidad de omisión de lista de permitidos que afectaba la autorización de ejecución de comandos. Los clientes de software actualizan a la versión de mantenimiento resuelta. Actualice todas las instalaciones de Commvault, incluyendo Commserve, Webserver, Command Center, Media Agents, Clients y HyperScale X."
}
],
"affected": [
{
"source": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"affectedData": [
{
"vendor": "Commvault",
"product": "Commvault Cloud",
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"versions": [
{
"version": "11.46.0",
"lessThanOrEqual": "11.46.9",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "11.46.10",
"status": "unaffected"
}
]
},
{
"version": "11.44.0",
"lessThanOrEqual": "11.44.10",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "11.44.11",
"status": "unaffected"
}
]
},
{
"version": "11.40.0",
"lessThanOrEqual": "11.40.62",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "11.40.63",
"status": "unaffected"
}
]
},
{
"version": "11.36.0",
"lessThanOrEqual": "11.36.113",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "11.36.114",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-11T16:48:52.032563Z",
"id": "CVE-2026-13737",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.36.0",
"versionEndExcluding": "11.36.114",
"matchCriteriaId": "E5FCA92D-2290-422E-87C1-BD8D658FAE62"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.40.0",
"versionEndExcluding": "11.40.63",
"matchCriteriaId": "451C852D-3BFD-4B09-8CFB-D8C56F09BD23"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.44.0",
"versionEndExcluding": "11.44.11",
"matchCriteriaId": "E8FC89DF-5702-44CE-A1B2-CBC081F14F38"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.46.0",
"versionEndExcluding": "11.46.10",
"matchCriteriaId": "7519E3A2-0575-43B2-AA81-C6171750B8BC"
}
]
}
]
}
],
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_8.html",
"source": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"tags": [
"Vendor Advisory"
]
}
]
}