{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77094", "assignerOrgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333", "state": "PUBLISHED", "assignerShortName": "Commvault", "dateReserved": "2026-08-20T10:56:58.071Z", "datePublished": "2026-10-13T14:27:00.178Z", "dateUpdated": "2026-10-13T14:27:00.178Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "050066fd-a2f9-4f32-ab5d-4c53f48bc333", "shortName": "Commvault", "dateUpdated": "2026-10-13T14:27:00.178Z"}, "title": "CvFWD Out-of-Bounds Write", "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-787: Out-of-bounds Write"}]}], "affected": [{"vendor": "Commvault", "product": "Commvault Cloud", "platforms": ["Windows", "Linux"], "defaultStatus": "unknown", "versions": [{"status": "affected", "version": "11.46.0", "lessThanOrEqual": "11.46.29", "changes": [{"at": "11.46.30", "status": "unaffected"}], "versionType": "custom"}, {"status": "affected", "version": "11.44.0", "lessThanOrEqual": "11.44.24", "changes": [{"at": "11.44.25", "status": "unaffected"}], "versionType": "custom"}, {"status": "affected", "version": "11.40.0", "lessThanOrEqual": "11.40.77", "changes": [{"at": "11.40.78", "status": "unaffected"}], "versionType": "custom"}, {"status": "affected", "version": "11.36.0", "lessThanOrEqual": "11.36.126", "changes": [{"at": "11.36.127", "status": "unaffected"}], "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale."}], "references": [{"url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_1.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase.", "type": "reporter"}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "platforms": ["Windows", "Linux"], "product": "Commvault Cloud", "vendor": "Commvault", "versions": [{"changes": [{"at": "11.46.30", "status": "unaffected"}], "lessThanOrEqual": "11.46.29", "status": "affected", "version": "11.46.0", "versionType": "custom"}, {"changes": [{"at": "11.44.25", "status": "unaffected"}], "lessThanOrEqual": "11.44.24", "status": "affected", "version": "11.44.0", "versionType": "custom"}, {"changes": [{"at": "11.40.78", "status": "unaffected"}], "lessThanOrEqual": "11.40.77", "status": "affected", "version": "11.40.0", "versionType": "custom"}, {"changes": [{"at": "11.36.127", "status": "unaffected"}], "lessThanOrEqual": "11.36.126", "status": "affected", "version": "11.36.0", "versionType": "custom"}]}], "source": "050066fd-a2f9-4f32-ab5d-4c53f48bc333"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale."}], "id": "CVE-2026-77094", "lastModified": "2026-10-13T15:17:49.143", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "050066fd-a2f9-4f32-ab5d-4c53f48bc333", "type": "Secondary"}]}, "published": "2026-10-13T15:17:49.143", "references": [{"source": "050066fd-a2f9-4f32-ab5d-4c53f48bc333", "url": "https://documentation.commvault.com/securityadvisories/CV_2026_10_1.html"}], "sourceIdentifier": "050066fd-a2f9-4f32-ab5d-4c53f48bc333", "vulnStatus": "Received"}

{}

{"created": "2026-10-13T18:15:17.470643+00:00", "updated": "2026-10-13T18:15:17.470648+00:00", "vendors": [], "weaknesses": ["CWE-119"]}