CyberICT

CVE-2026-13738

Commvault · Published August 11, 2026

CVSS v3.1

CRITICAL
Patch availableGet patch

Description

CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

Affected Products

  • Commvault < 11.36.114
  • Commvault < 11.40.63
  • Commvault < 11.44.11
  • Commvault < 11.46.10

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H