{"id":"CVE-2026-77094","state":"PUBLISHED","title":"CvFWD Out-of-Bounds Write","description":"CvFWD contained an out-of-bounds write affecting service availability.  Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.","publishedAt":"2026-10-13T14:27:00.178Z","updatedAt":"2026-10-14T18:53:48.467Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"Commvault"},"assigner":"Commvault","products":["Commvault Commvault Cloud"],"affected":[{"vendor":"Commvault","product":"Commvault Cloud","defaultStatus":"unknown","versions":[{"version":"11.46.0","status":"affected","lessThanOrEqual":"11.46.29","changes":[{"at":"11.46.30","status":"unaffected"}],"versionType":"custom"},{"version":"11.44.0","status":"affected","lessThanOrEqual":"11.44.24","changes":[{"at":"11.44.25","status":"unaffected"}],"versionType":"custom"},{"version":"11.40.0","status":"affected","lessThanOrEqual":"11.40.77","changes":[{"at":"11.40.78","status":"unaffected"}],"versionType":"custom"},{"version":"11.36.0","status":"affected","lessThanOrEqual":"11.36.126","changes":[{"at":"11.36.127","status":"unaffected"}],"versionType":"custom"}],"platforms":["Windows","Linux"]}],"references":["https://documentation.commvault.com/securityadvisories/CV_2026_10_1.html"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/77xxx/CVE-2026-77094.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-77094","state":"PUBLISHED","datePublished":"2026-10-13T14:27:00.178Z","dateUpdated":"2026-10-14T18:53:48.467Z","assignerShortName":"Commvault","assignerOrgId":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","dateReserved":"2026-08-20T10:56:58.071Z"},"containers":{"cna":{"title":"CvFWD Out-of-Bounds Write","descriptions":[{"lang":"en","value":"CvFWD contained an out-of-bounds write affecting service availability.  Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale."}],"affected":[{"vendor":"Commvault","product":"Commvault Cloud","defaultStatus":"unknown","versions":[{"version":"11.46.0","status":"affected","lessThanOrEqual":"11.46.29","changes":[{"at":"11.46.30","status":"unaffected"}],"versionType":"custom"},{"version":"11.44.0","status":"affected","lessThanOrEqual":"11.44.24","changes":[{"at":"11.44.25","status":"unaffected"}],"versionType":"custom"},{"version":"11.40.0","status":"affected","lessThanOrEqual":"11.40.77","changes":[{"at":"11.40.78","status":"unaffected"}],"versionType":"custom"},{"version":"11.36.0","status":"affected","lessThanOrEqual":"11.36.126","changes":[{"at":"11.36.127","status":"unaffected"}],"versionType":"custom"}],"platforms":["Windows","Linux"]}],"references":[{"url":"https://documentation.commvault.com/securityadvisories/CV_2026_10_1.html"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"version":"4.0","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-787: Out-of-bounds Write"}]}],"providerMetadata":{"shortName":"Commvault","orgId":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","dateUpdated":"2026-10-13T14:27:00.178Z"},"credits":[{"lang":"en","value":"Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase.","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-14T18:53:28.173537Z","id":"CVE-2026-77094","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","type":"CWE","lang":"en","description":"CWE-787 Out-of-bounds Write"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-14T18:53:48.467Z"}}]}}}