Priority CRITICAL 99KEV
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability…
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.97555 · Published 2025-04-22 · No fix listed CWE-22
Priority CRITICAL 97KEV
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.02527 · Published 2025-04-25 · Fixed in 11.36.46, 11.32.89 +2 CWE-94
Priority HIGH 79
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.82258 · Published 2022-01-13 · No fix listed CWE-749
Priority HIGH 79
A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.68732 · Published 2018-01-19 · No fix listed CWE-78
Priority HIGH 75
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.68864 · Published 2022-01-13 · No fix listed CWE-434
Priority HIGH 68
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.43606 · Published 2025-08-20 · No fix listed CWE-36
Priority MEDIUM 63
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.38788 · Published 2025-08-20 · No fix listed CWE-88
Priority MEDIUM 61
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to arbitrary code execution with administrative…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.21387 · Published 2017-12-15 · No fix listed CWE-121
Priority MEDIUM 51
This vulnerability allows remote attackers to bypass authentication on affected installations of Commvault CommCell 11.22.22.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.05827 · Published 2022-01-13 · No fix listed CWE-287
Priority MEDIUM 50
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized data in a cookie.
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.03996 · Published 2015-11-04 · No fix listed CWE-78
Priority MEDIUM 49
Command Center API contained an authentication bypass issue affecting privilege management.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00611 · Published 2026-09-08 · No fix listed CWE-290
Priority MEDIUM 48
CVFS contained an input validation issue affecting command execution.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00388 · Published 2026-10-13 · No fix listed CWE-78
Priority MEDIUM 47
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.07762 · Published 2025-08-20 · No fix listed CWE-259
Priority MEDIUM 47
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.05978 · Published 2022-01-13 · No fix listed CWE-20
Priority MEDIUM 45
A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00483 · Published 2026-08-11 · No fix listed CWE-918
Priority MEDIUM 45
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.04387 · Published 2022-01-13 · No fix listed CWE-434
Priority MEDIUM 45
In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal can occur such that an attempt to view a log file can instead view a file outside…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.09884 · Published 2020-10-29 · No fix listed CWE-22
Priority MEDIUM 44
The network messaging layer contained improper handling of highly compressed data affecting service availability.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00356 · Published 2026-10-13 · No fix listed CWE-409
Priority MEDIUM 44
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0033 · Published 2026-10-13 · No fix listed CWE-611
Priority MEDIUM 44
CommServe contained a heap-based buffer overflow issue affecting service availability.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00458 · Published 2026-09-08 · No fix listed CWE-122
Priority MEDIUM 44
CommServe contained a stack-based buffer overflow issue affecting service availability.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00458 · Published 2026-09-08 · No fix listed CWE-121
Priority MEDIUM 44
Private Metrics Server contained an SQL injection condition affecting database operations.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00468 · Published 2026-09-08 · No fix listed CWE-89
Priority MEDIUM 44
Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00466 · Published 2026-09-08 · No fix listed CWE-306
Priority MEDIUM 43
MediaAgent contained a heap-based buffer overflow issue affecting service availability.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00316 · Published 2026-10-13 · No fix listed CWE-122
Priority MEDIUM 43
CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.00671 · Published 2026-08-11 · No fix listed CWE-863
Load more
THREATIST.IORead the docs