CVE-2026-77099 PUBLISHED

CVFS Command Execution

Assigner: Commvault
Reserved: 20.08.2026 Published: 13.10.2026 Updated: 13.10.2026

CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Product Status

Vendor Commvault
Product Commvault Cloud
Versions Default: unknown
  • affected from 11.46.0 to 11.46.29 (incl.)
  • affected from 11.44.0 to 11.44.24 (incl.)
  • affected from 11.40.0 to 11.40.77 (incl.)
  • affected from 11.36.0 to 11.36.126 (incl.)
Vendor Commvault
Product Grid(HSX) CVFS
Versions Default: unknown
  • affected from 5.0.1.0 to 5.0.14.4 (incl.)

Credits

  • Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase. reporter

References

Problem Types

  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')