Commvault vulnerabilities

40 published CVEs name Commvault among the affected products; CISA lists 2 of them as exploited in the wild.

Critical 7High 28Medium 4Low 1Not scored 0

CVEs per yearBy the year they were published

CVE-2025-34028
Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
Commvault · Command Center Innovation Release
ExploitedCritical9.3
CVE-2025-3928
Commvault Web Server unspecified vulnerability
Commvault · Web Server
ExploitedHigh8.7

CVE-2026-97334
Network messaging layer decompression resource exhaustion
Commvault · Commvault Cloud
High8.7
CVE-2026-97333
QAPI stack-based buffer overflow
Commvault · Commvault Cloud
High7.1
CVE-2026-77100
MediaAgent Denial of Service
Commvault · Commvault Cloud
High8.7
CVE-2026-77099
CVFS Command Execution
Commvault · Commvault Cloud
Critical9.3
CVE-2026-77096
CVFS Missing Authentication
Commvault · Commvault Cloud
High7.7
CVE-2026-77095
CvFWD Null Pointer Dereference
Commvault · Commvault Cloud
High7.1
CVE-2026-77094
CvFWD Out-of-Bounds Write
Commvault · Commvault Cloud
High7.1
CVE-2026-77093
CvFWD Denial of Service
Commvault · Commvault Cloud
High7.1
CVE-2026-77090
CVFS Information Disclosure
Commvault · Commvault Cloud
High8.7
CVE-2026-18228
Hyperscale Path Traversal
Commvault · Commvault Cloud
High7.1