CVE Intelligence
Analysis AI-assisted

CVE-2026-77099: Commvault CVFS Command Injection

CVE-2026-77099 is a critical input validation issue in Commvault CVFS that the record classifies as OS command injection (CWE-78). The record reports a CVSS 4.0 score of 9.3 and lists affected ranges for Commvault Cloud and Grid(HSX) CVFS, but no fixed versions. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-77099 affects Commvault CVFS and was published by Commvault as CNA. The record classifies it as OS command injection (CWE-78) arising from an input validation weakness that affects command execution. The vendor advisory is linked in the references below: Commvault security advisory.

Impact

The record reports a CVSS 4.0 base score of 9.3 and a vector indicating high impact on confidentiality, integrity and availability of the vulnerable system. SSVC data in the record marks technical impact as total and automatable as yes. These are assessments carried in the record and were not independently verified here.

Affected products and versions

  • Commvault Commvault Cloud: ≥ 11.46.0 and ≤ 11.46.29; ≥ 11.44.0 and ≤ 11.44.24; ≥ 11.40.0 and ≤ 11.40.77; ≥ 11.36.0 and ≤ 11.36.126
  • Commvault Grid(HSX) CVFS: ≥ 5.0.1.0 and ≤ 5.0.14.4

The record lists no fixed versions. Its description tells customers to upgrade to a resolved maintenance release, but it does not identify which release that is.

Exploitation status

The record shows this CVE is not listed in CISA KEV and has no EPSS value. SSVC exploitation is recorded as none. No confirmed exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Check the vendor advisory linked above and identify the maintenance release that resolves the issue for each product line in use.
  • Upgrade affected Commvault Cloud and Grid(HSX) CVFS deployments to the release the vendor designates as fixed.
  • Reduce exposure of affected systems where operationally feasible, as general hardening, until vendor guidance is applied.
  • Prioritize this issue given the critical rating and the total technical impact recorded in SSVC.

Detection guidance

  • Review inventories to identify hosts running versions in the affected ranges.
  • Monitor for unexpected processes launched by Commvault services and for unusual administrative activity, and correlate these with change records.

Limitations of the available information

The record does not describe the vulnerable component, the preconditions for exploitation, the fixed versions or the advisory content itself. Whether any vendor-supplied mitigation exists beyond upgrading is unknown from this record.

Frequently asked questions

Is CVE-2026-77099 being actively exploited?

CISA KEV does not list this CVE in the record, and SSVC exploitation is recorded as none. No confirmed exploitation appears in the sources consulted.

Which Commvault versions are affected?

The record lists ranges for Commvault Cloud and for Grid(HSX) CVFS. Check the vendor advisory to confirm applicability to your environment.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.