# cve.now: Commvault

The newest entries naming Commvault as an affected vendor (up to 200), of 40 in all, 2 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-97334](https://cve.now/CVE-2026-97334.md): Network messaging layer decompression resource exhaustion (CVSS 8.7)
- [CVE-2026-97333](https://cve.now/CVE-2026-97333.md): QAPI stack-based buffer overflow (CVSS 7.1)
- [CVE-2026-77100](https://cve.now/CVE-2026-77100.md): MediaAgent Denial of Service (CVSS 8.7)
- [CVE-2026-77099](https://cve.now/CVE-2026-77099.md): CVFS Command Execution (CVSS 9.3)
- [CVE-2026-77096](https://cve.now/CVE-2026-77096.md): CVFS Missing Authentication (CVSS 7.7)
- [CVE-2026-77095](https://cve.now/CVE-2026-77095.md): CvFWD Null Pointer Dereference (CVSS 7.1)
- [CVE-2026-77094](https://cve.now/CVE-2026-77094.md): CvFWD Out-of-Bounds Write (CVSS 7.1)
- [CVE-2026-77093](https://cve.now/CVE-2026-77093.md): CvFWD Denial of Service (CVSS 7.1)
- [CVE-2026-77090](https://cve.now/CVE-2026-77090.md): CVFS Information Disclosure (CVSS 8.7)
- [CVE-2026-18228](https://cve.now/CVE-2026-18228.md): Hyperscale Path Traversal (CVSS 7.1)
- [CVE-2026-77106](https://cve.now/CVE-2026-77106.md): Cvlaunchd Code Execution (CVSS 7.7)
- [CVE-2026-77105](https://cve.now/CVE-2026-77105.md): CommServe Privilege Escalation (CVSS 8.7)
- [CVE-2026-77104](https://cve.now/CVE-2026-77104.md): CommServe Path Traversal (CVSS 8.3)
- [CVE-2026-77103](https://cve.now/CVE-2026-77103.md): CommServe Information Disclosure (CVSS 8.7)
- [CVE-2026-77102](https://cve.now/CVE-2026-77102.md): CommServe Denial of Service (CVSS 8.7)
- [CVE-2026-77101](https://cve.now/CVE-2026-77101.md): CommServe Stack-based Buffer Overflow (CVSS 8.7)
- [CVE-2026-77098](https://cve.now/CVE-2026-77098.md): Private Metrics Server SQL Injection (CVSS 8.8)
- [CVE-2026-77097](https://cve.now/CVE-2026-77097.md): Private Metrics Server Denial of Service (CVSS 8.8)
- [CVE-2026-77092](https://cve.now/CVE-2026-77092.md): Content Extractor Privilege Escalation (CVSS 7.3)
- [CVE-2026-77091](https://cve.now/CVE-2026-77091.md): DataCube Security Feature Bypass (CVSS 8.5)
- [CVE-2026-77089](https://cve.now/CVE-2026-77089.md): Command Center API Authentication Bypass (CVSS 9.3)
- [CVE-2026-13738](https://cve.now/CVE-2026-13738.md): Improper Authorization Validation (CVSS 9.2)
- [CVE-2026-13737](https://cve.now/CVE-2026-13737.md): Command Restriction Bypass (CVSS 9.2)
- [CVE-2026-13739](https://cve.now/CVE-2026-13739.md): Server-Side Request Forgery (SSRF) (CVSS 8.8)
- [CVE-2025-12776](https://cve.now/CVE-2025-12776.md): Stored Cross-Site Scripting (CVSS 1.8)
- [CVE-2025-57791](https://cve.now/CVE-2025-57791.md): Argument Injection Vulnerability in CommServe (CVSS 6.9)
- [CVE-2025-57790](https://cve.now/CVE-2025-57790.md): Path Traversal Vulnerability (CVSS 8.7)
- [CVE-2025-57789](https://cve.now/CVE-2025-57789.md): Vulnerability in Initial Administrator Login Process (CVSS 5.3)
- [CVE-2025-57788](https://cve.now/CVE-2025-57788.md): Unauthorized API Access Risk (CVSS 6.9)
- [CVE-2024-13976](https://cve.now/CVE-2024-13976.md): Commvault 11.20.0 - 11.36.0 Windows Maintenance Installer DLL Injection (CVSS 8.5)
- [CVE-2024-13975](https://cve.now/CVE-2024-13975.md): Commvault 11.20.0 - 11.36.0 Windows Access Nodes Compromise via Local File Server Agent Abuse (CVSS 8.5)
- [CVE-2025-34136](https://cve.now/CVE-2025-34136.md): Commvault CommServe Web Server Unauthenticated SQL Injection (CVSS 6.9)
- [CVE-2025-3928](https://cve.now/CVE-2025-3928.md): Commvault Web Server unspecified vulnerability (CVSS 8.8, KEV)
- [CVE-2025-34028](https://cve.now/CVE-2025-34028.md): Commvault Command Center Innovation Release \<= 11.38.25 Unathenticated Install Package Path Traversal (CVSS 9.3, KEV)
- [CVE-2021-34997](https://cve.now/CVE-2021-34997.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. (CVSS 8.8)
- [CVE-2021-34996](https://cve.now/CVE-2021-34996.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. (CVSS 8.8)
- [CVE-2021-34995](https://cve.now/CVE-2021-34995.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. (CVSS 8.8)
- [CVE-2021-34994](https://cve.now/CVE-2021-34994.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. (CVSS 8.8)
- [CVE-2021-34993](https://cve.now/CVE-2021-34993.md): This vulnerability allows remote attackers to bypass authentication on affected installations of Commvault CommCell 11.22.22. (CVSS 9.8)
- [CVE-2017-3195](https://cve.now/CVE-2017-3195.md): Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overfl (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/commvault
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.