CVE-2026-13737

CriticalCVSS 9.8/10Last modified Oct 23, 2026

Description

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Commvault	Commvault Cloud	>= 11.46.0, <= 11.46.9; >= 11.44.0, <= 11.44.10; >= 11.40.0, <= 11.40.62; >= 11.36.0, <= 11.36.113

References

https://documentation.commvault.com/securityadvisories/CV_2026_07_8.htmlVendor Advisory

Timeline

Published: Aug 11, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-137389.8CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgra CVE-2026-137399.8A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of CVE-2026-137418.8The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and i CVE-2026-137425.9Honeywell IQ MultiAccess, all versions prior to and including version 28, contain an improper digital signature verification vulnerability. CVE-2026-137433.3CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 are vulnerable to an Improper Verification of Cryptographic Signature vuln CVE-2026-137448.8Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplyin CVE-2026-137457.7A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into sta CVE-2026-137465.4Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigg CVE-2026-137476.5The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the p CVE-2026-137486.3Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and tra CVE-2026-137498.8Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 allowed arbitrary cod CVE-2026-13758.1The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all v