CVE-2026-77106
published 2026-09-08CVE-2026-77106: Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update…
PriorityP354high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.30%
23.5th percentile
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| commvault | commvault | >= 11.36.0 < 11.36.123 | 11.36.123 |
| commvault | commvault | >= 11.40.0 < 11.40.72 | 11.40.72 |
| commvault | commvault | >= 11.44.0 < 11.44.20 | 11.44.20 |
| commvault | commvault | >= 11.46.0 < 11.46.20 | 11.46.20 |
| commvault | commvault_cloud | 11.36.0 – 11.36.122 | — |
| commvault | commvault_cloud | 11.40.0 – 11.40.71 | — |
| commvault | commvault_cloud | 11.44.0 – 11.44.19 | — |
| commvault | commvault_cloud | 11.46.0 – 11.46.19 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.7HIGHCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Commvault up to 11.36.122/11.40.71/11.44.19/11.46.19 Cvlaunchd authorization
vuldb·2026-09-13·CVSS 8.8
CVE-2026-77106 [HIGH] Commvault up to 11.36.122/11.40.71/11.44.19/11.46.19 Cvlaunchd authorization
A vulnerability, which was classified as very critical, has been found in Commvault up to 11.36.122/11.40.71/11.44.19/11.46.19. This issue affects some unknown processing of the component Cvlaunchd. This manipulation causes missing authorization.
The identification of this vulnerability is CVE-2026-77106. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
Cvlaunchd contained a missing authorization issue affecting command execution authorization.
ghsa_unreviewed·2026-09-08
CVE-2026-77106 [HIGH] CWE-862 Cvlaunchd contained a missing authorization issue affecting command execution authorization.
Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-08
Published