CVE-2026-13737: CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release…

PriorityP260critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.52%

42.3th percentile

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
commvault	commvault	>= 11.36.0 < 11.36.114	11.36.114
commvault	commvault	>= 11.40.0 < 11.40.63	11.40.63
commvault	commvault	>= 11.44.0 < 11.44.11	11.44.11
commvault	commvault	>= 11.46.0 < 11.46.10	11.46.10
commvault	commvault_cloud	11.36.0 – 11.36.113	—
commvault	commvault_cloud	11.40.0 – 11.40.62	—
commvault	commvault_cloud	11.44.0 – 11.44.10	—
commvault	commvault_cloud	11.46.0 – 11.46.9	—

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.