Commvault vulnerabilities and fixes

CVEs that mention Commvault, ranked by priority. 3 tracked.

Commvault has 3 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-08-11. Highest priority: CVE-2026-13738 (score 52/100).

• CVE-2026-13738 CRITICAL 9.8 UPGRADE CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operati
• CVE-2026-13737 CRITICAL 9.8 UPGRADE CommServe contained an allowlist bypass vulnerability affecting command execution authorization
• CVE-2026-13739 CRITICAL 9.8 UPGRADE A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerabil

FAQ

How do I fix Commvault vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Commvault being exploited right now?

None of the tracked Commvault CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Commvault CVE should I patch first?

CVE-2026-13738 currently ranks highest (52/100): CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operati.

← Back to latest CVEs