Unauthenticated Server-Side Request Forgery in Command Center by Commvault
CVE-2026-13739

8.8HIGH

Key Information:

Vendor

Commvault

Status
Commvault Cloud
Vendor
CVE Published:
11 August 2026

What is CVE-2026-13739?

A legacy endpoint in Commvault's Command Center is affected by an unauthenticated server-side request forgery (SSRF) vulnerability, which allows attackers to manipulate arbitrary target URLs. This vulnerability can be exploited to retrieve sensitive information from internal systems. Users are advised to upgrade to the latest maintenance release to mitigate this issue.

Affected Version(s)

Commvault Cloud Windows 11.46.0 <= 11.46.9

Commvault Cloud Windows 11.44.0 <= 11.44.10

Commvault Cloud Windows 11.40.0 <= 11.40.62

References

https://documentation.commvault.com/securityadvisories/CV...

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter V., Principal Researcher, CFC Security LTD.
.