CVE-2026-77103

HighCVSS 7.5/10Last modified Sep 9, 2026

Description

CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-288

Affected software

Vendor	Product	Versions
Commvault	Commvault Cloud	>= 11.46.0, <= 11.46.19; >= 11.44.0, <= 11.44.19; >= 11.40.0, <= 11.40.71; >= 11.36.0, <= 11.36.122

References

https://documentation.commvault.com/securityadvisories/CV_2026_08_5.htmlVendor Advisory

Timeline

Published: Sep 8, 2026
Last modified: Sep 9, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-771047.5CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Upd CVE-2026-771058.8CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved main CVE-2026-771068.8Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintena CVE-2026-771087.5Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage CVE-2026-771098.6Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage CVE-2026-77117.3A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/handlers/byom_handler CVE-2026-771107.6Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could res CVE-2026-771118.7Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high CVE-2026-771126.5Server-Side request forgery (SSRF) vulnerability in Global IT Informatics Technology Services Inc. Weoll allows Server Side Request Forgery.CVE-2026-771136.7Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arb CVE-2026-771147.2The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all v CVE-2026-771157.1Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.