CVE-2026-13739 | | | 2026-08-11 | A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target U… |
CVE-2026-13738 | | | 2026-08-11 | CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved main… |
CVE-2026-13737 | | | 2026-08-11 | CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. U… |
CVE-2025-12776 | Medium | 5.4 | 2026-01-07 | The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible… |
CVE-2025-57791 | Medium | 6.5 | 2025-08-20 | A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to i… |
CVE-2025-57790 | High | 8.8 | 2025-08-20 | A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. The vulner… |
CVE-2025-57789 | Medium | 5.4 | 2025-08-20 | During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This… |
CVE-2025-57788 | Medium | 6.5 | 2025-08-20 | A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the expos… |
CVE-2025-34136 | | | 2025-07-25 | An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, un… |
CVE-2024-13976 | | | 2025-07-25 | A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates… |
CVE-2024-13975 | | | 2025-07-25 | A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations… |
CVE-2025-3928 | High | 8.8 | 2025-04-25 | Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webserve… |
CVE-2025-34028 | Critical | 10.0 | 2025-04-22 | The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the… |
CVE-2021-34997 | High | 8.8 | 2022-01-13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is requi… |
CVE-2021-34996 | High | 8.8 | 2022-01-13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is requi… |
CVE-2021-34995 | High | 8.8 | 2022-01-13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is requi… |
CVE-2021-34994 | High | 8.8 | 2022-01-13 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is requi… |
CVE-2021-34993 | Critical | 9.8 | 2022-01-13 | This vulnerability allows remote attackers to bypass authentication on affected installations of Commvault CommCell 11.22.22. Authentication is not required to… |
CVE-2020-25780 | High | 7.5 | 2020-10-29 | In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal can occur such that… |
CVE-2017-18044 | Critical | 9.8 | 2018-01-19 | A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvau… |
CVE-2017-3195 | Critical | 9.8 | 2017-12-16 | Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability th… |
CVE-2015-7253 | | | 2015-11-04 | The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized data in a cookie. |