{"id":"CVE-2026-13737","state":"PUBLISHED","title":"Command Restriction Bypass","description":"CommServe contained an allowlist bypass vulnerability affecting command execution authorization.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.","publishedAt":"2026-08-11T11:01:38.785Z","updatedAt":"2026-08-11T16:49:09.354Z","severity":{"score":9.2,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"Commvault"},"assigner":"Commvault","products":["Commvault Commvault Cloud"],"affected":[{"vendor":"Commvault","product":"Commvault Cloud","defaultStatus":"unknown","versions":[{"version":"11.46.0","status":"affected","lessThanOrEqual":"11.46.9","changes":[{"at":"11.46.10","status":"unaffected"}],"versionType":"custom"},{"version":"11.44.0","status":"affected","lessThanOrEqual":"11.44.10","changes":[{"at":"11.44.11","status":"unaffected"}],"versionType":"custom"},{"version":"11.40.0","status":"affected","lessThanOrEqual":"11.40.62","changes":[{"at":"11.40.63","status":"unaffected"}],"versionType":"custom"},{"version":"11.36.0","status":"affected","lessThanOrEqual":"11.36.113","changes":[{"at":"11.36.114","status":"unaffected"}],"versionType":"custom"}],"platforms":["Windows","Linux"]}],"references":["https://documentation.commvault.com/securityadvisories/CV_2026_07_8.html"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/13xxx/CVE-2026-13737.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-13737","state":"PUBLISHED","datePublished":"2026-08-11T11:01:38.785Z","dateUpdated":"2026-08-11T16:49:09.354Z","assignerShortName":"Commvault","assignerOrgId":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","dateReserved":"2026-06-29T14:54:15.451Z"},"containers":{"cna":{"title":"Command Restriction Bypass","descriptions":[{"lang":"en","value":"CommServe contained an allowlist bypass vulnerability affecting command execution authorization.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X."}],"affected":[{"vendor":"Commvault","product":"Commvault Cloud","defaultStatus":"unknown","versions":[{"version":"11.46.0","status":"affected","lessThanOrEqual":"11.46.9","changes":[{"at":"11.46.10","status":"unaffected"}],"versionType":"custom"},{"version":"11.44.0","status":"affected","lessThanOrEqual":"11.44.10","changes":[{"at":"11.44.11","status":"unaffected"}],"versionType":"custom"},{"version":"11.40.0","status":"affected","lessThanOrEqual":"11.40.62","changes":[{"at":"11.40.63","status":"unaffected"}],"versionType":"custom"},{"version":"11.36.0","status":"affected","lessThanOrEqual":"11.36.113","changes":[{"at":"11.36.114","status":"unaffected"}],"versionType":"custom"}],"platforms":["Windows","Linux"]}],"references":[{"url":"https://documentation.commvault.com/securityadvisories/CV_2026_07_8.html"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"version":"4.0","baseScore":9.2,"baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-863: Incorrect Authorization"}]}],"providerMetadata":{"shortName":"Commvault","orgId":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","dateUpdated":"2026-08-11T11:01:38.785Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-11T16:48:52.032563Z","id":"CVE-2026-13737","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","type":"CWE","lang":"en","description":"CWE-863 Incorrect Authorization"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-11T16:49:09.354Z"}}]}}}