CVE-2026-13737Commvault Commvault Cloud
NVD
Vulnerability Summary
CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
CVSS v4.0 Base Metrics — Score 9.2 (CRITICAL)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NAttack VectorNetwork
Attack ComplexityHigh
Attack RequirementsNone
Privileges RequiredNone
User InteractionNone
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)High
Availability (Vulnerable System)High
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
Affected & Patched Versions
- Commvault Commvault Cloud >= 11.46.0 and <= 11.46.9
- Commvault Commvault Cloud >= 11.44.0 and <= 11.44.10
- Commvault Commvault Cloud >= 11.40.0 and <= 11.40.62
- Commvault Commvault Cloud >= 11.36.0 and <= 11.36.113
- Commvault Commvault Cloud 11.46.9
- Commvault Commvault Cloud 11.44.10
- Commvault Commvault Cloud 11.40.62
- Commvault Commvault Cloud 11.36.113
What to do
Fix it during your normal patch cycle. No exploitation is confirmed yet.
- Check whether you run Commvault Commvault Cloud and which version.
- Update to a patched version listed above, then confirm the new version.
Timeline
- Aug 11, 2026Published
- Aug 11, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Get notified about new Commvault Commvault Cloud CVEsYou are reading CVE-2026-13737. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alertsRelated Coverage
External References
Data last checked: Nov 15, 2026 03:31 UTC