Commvault patches critical command execution flaw in its CVFS storage

Commvault patches critical command execution flaw in its CVFS storage

13 October 2026: Commvault has fixed CVE-2026-77099, a critical input validation flaw in CVFS, the distributed file system under its HyperScale X and Commvault Grid appliances, that allows command execution. Commvault scores it 9.3 under CVSS 4.0, and the vector describes an attack over the network with no privileges and no user interaction. It is one of ten advisories Commvault published on 13 October.

Not yet independently verified. Commvault does not say whether any of the ten flaws has been exploited, and we read the full text of only the CVFS command execution advisory; the other nine are described from Commvault's index of titles. We will update this when it can be confirmed, and remove this note.

Which versions are fixed

The advisory, CV_2026_10_9, lists these affected Linux releases and their fixes:

• Commvault 11.46.0 to 11.46.29: fixed in 11.46.30
• Commvault 11.44.0 to 11.44.24: fixed in 11.44.25
• Commvault 11.40.0 to 11.40.77: fixed in 11.40.78
• Commvault 11.36.0 to 11.36.126: fixed in 11.36.127
• Grid (HSX) CVFS 5.0.1.0 to 5.0.14.4: fixed in 5.0.14.5

Commvault says supported versions not listed are unaffected and unsupported versions must be upgraded. The order of work matters. On Commvault Cloud 11.36 and 11.40, administrators first upgrade Commvault to the fixed maintenance release and then upgrade CVFS separately. On 11.44 and later, upgrading HyperScale X to the fixed release brings the CVFS update with it. The advisory explains how to confirm that every node shows the same CVFS version, through Command Center for 11.44 and later or a shell script on older releases.

The flaw was reported by Michael Tucker and Tan Chew Keong of the XOR team at JPMorgan Chase.

Nine more advisories the same day

Commvault's advisory index lists nine further issues dated 13 October: a missing authentication flaw and an information disclosure in CVFS, an out-of-bounds write and a null pointer dereference in the CvFWD component, a denial of service in the Media Agent, a path traversal in HyperScale, a stack-based buffer overflow in QAPI, a decompression resource exhaustion in the network messaging layer, and one further denial of service. Canada's Cyber Centre summarised the batch in advisory AV26-1033 the same day.

Why backup appliances need fast patching

Backup systems are a favoured target because they hold copies of everything and, if compromised, stop an organisation recovering from ransomware. A command execution flaw that needs no login on the storage layer of a backup appliance is the kind of bug attackers look for. Teams running HyperScale X or Grid should keep the appliances' management interfaces off networks that ordinary users and the internet can reach while they schedule the upgrade.

Backup in our catalogue

We list Commvault as a company, and our server backup category lists 20 products.

Update, 22 October 2026: Canada's Cyber Centre listed the affected Commvault products in bulletin AV26-1033 on 13 October without reporting exploitation, and NVD published CVE-2026-77099 the same day. The CVE was not in CISA's catalogue of exploited vulnerabilities as of 21 October.

Related on TrustList:

• Dell fixes four CVSS 9.8 flaws in PowerProtect Data Domain
• Proof-of-concept code is out for ten flaws rclone fixed in 1.75.2
• Veeam fixes a critical authorization bypass in Backup & Replication 13

Sources

• Commvault: CV_2026_10_9, CVFS Command Execution, 13 October 2026
• Commvault: Commvault Cloud Security Advisories (index), 13 October 2026
• Canadian Centre for Cyber Security: Commvault security advisory AV26-1033, 13 October 2026
• Canadian Centre for Cyber Security: Commvault security advisory (AV26-1033) - 13 October 2026