CVE-2026-13739
Full vulnerability record from the local CVENow database.
Description
A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.
Severity
HIGH
CVSS score
8.8
(v4.0)
Vulnerability status
Analyzed
Source identifier
050066fd-a2f9-4f32-ab5d-4c53f48bc333
Published
2026-08-11 12:17:38.047000
Last modified
2026-10-23 19:10:00.167000
View original CVE JSON
{
"id": "CVE-2026-13739",
"sourceIdentifier": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"published": "2026-08-11T12:17:38.047",
"lastModified": "2026-10-23T19:10:00.167",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center."
},
{
"lang": "es",
"value": "Un endpoint heredado en Command Center contenía una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) no autenticada relacionada con el manejo de URLs objetivo arbitrarias. Los clientes de software actualizan a la versión de mantenimiento resuelta. Actualice Command Center."
}
],
"affected": [
{
"source": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"affectedData": [
{
"vendor": "Commvault",
"product": "Commvault Cloud",
"defaultStatus": "unknown",
"platforms": [
"Windows",
"Linux"
],
"versions": [
{
"version": "11.46.0",
"lessThanOrEqual": "11.46.9",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "11.46.10",
"status": "unaffected"
}
]
},
{
"version": "11.44.0",
"lessThanOrEqual": "11.44.10",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "11.44.11",
"status": "unaffected"
}
]
},
{
"version": "11.40.0",
"lessThanOrEqual": "11.40.62",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "11.40.63",
"status": "unaffected"
}
]
},
{
"version": "11.36.0",
"lessThanOrEqual": "11.36.113",
"versionType": "custom",
"status": "affected",
"changes": [
{
"at": "11.36.114",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-11T14:13:11.777885Z",
"id": "CVE-2026-13739",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.36.0",
"versionEndExcluding": "11.36.114",
"matchCriteriaId": "E5FCA92D-2290-422E-87C1-BD8D658FAE62"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.40.0",
"versionEndExcluding": "11.40.63",
"matchCriteriaId": "451C852D-3BFD-4B09-8CFB-D8C56F09BD23"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.44.0",
"versionEndExcluding": "11.44.11",
"matchCriteriaId": "E8FC89DF-5702-44CE-A1B2-CBC081F14F38"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*",
"versionStartIncluding": "11.46.0",
"versionEndExcluding": "11.46.10",
"matchCriteriaId": "7519E3A2-0575-43B2-AA81-C6171750B8BC"
}
]
}
]
}
],
"references": [
{
"url": "https://documentation.commvault.com/securityadvisories/CV_2026_07_5.html",
"source": "050066fd-a2f9-4f32-ab5d-4c53f48bc333",
"tags": [
"Vendor Advisory"
]
}
]
}