Authorization Bypass Vulnerability in Commvault Products
CVE-2026-13738

9.2CRITICAL

Key Information:

Vendor

Commvault

Status
Commvault Cloud
Vendor
CVE Published:
11 August 2026

What is CVE-2026-13738?

Commvault's CommServe has a vulnerability that allows unauthorized command execution due to an authorization bypass. Affected customers are strongly advised to update all installations, including the CommServe, Webserver, Command Center, Media Agents, Clients, and HyperScale X, to the latest maintenance release to mitigate potential security risks.

Affected Version(s)

Commvault Cloud Windows 11.46.0 <= 11.46.9

Commvault Cloud Windows 11.44.0 <= 11.44.10

Commvault Cloud Windows 11.40.0 <= 11.40.62

References

https://documentation.commvault.com/securityadvisories/CV...

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.