Skip to content
CVE PROGRAM SOURCE RECORD9.2 Critical

CVE-2026-13737

Command Restriction Bypass

Description

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Commvault Commvault Cloud

Default version status: unknown

  • 11.46.0 to ≤ 11.46.9affected
  • 11.44.0 to ≤ 11.44.10affected
  • 11.40.0 to ≤ 11.40.62affected
  • 11.36.0 to ≤ 11.36.113affected

References