CyberICT

CVE-2026-13739

Commvault · Published August 11, 2026

CVSS v3.1

CRITICAL
Patch availableGet patch

Description

A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.

Affected Products

  • Commvault < 11.36.114
  • Commvault < 11.40.63
  • Commvault < 11.44.11
  • Commvault < 11.46.10

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H