CVE-2026-77106: 
Commvault vulnerability analysis and mitigation

CVE-2026-77106 is a missing authorization vulnerability in Commvault's cvlaunchd daemon that allows authenticated low-privileged users to bypass command execution authorization controls. It affects Commvault and Commvault Cloud across multiple release trains: versions 11.36.0–11.36.122, 11.40.0–11.40.71, 11.44.0–11.44.19, and 11.46.0–11.46.19. The vulnerability was published on September 8, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Commvault Advisory).

The root cause is classified as CWE-862 (Missing Authorization): the cvlaunchd process fails to perform adequate authorization checks before permitting command execution, allowing a low-privileged authenticated user to invoke commands that should require elevated privileges. The attack vector is network-based, requiring low privileges and no user interaction, though CVSS v4.0 notes high attack complexity and the presence of attack requirements (specific deployment conditions must be met). No public proof-of-concept or detailed technical write-up describing the precise exploitation mechanism has been published as of the advisory date (GitHub Advisory, Commvault Advisory).

Successful exploitation allows any authenticated low-privileged user to execute arbitrary commands with elevated privileges on affected Commvault infrastructure components, resulting in high impact to confidentiality, integrity, and availability of the vulnerable system. An attacker could read sensitive backup data and credentials, modify system configurations, corrupt or delete backup jobs, and disrupt service availability across Commserve, Webserver, Command Center, Media Agents, Clients, and HyperScale X nodes. Given Commvault's role as a centralized backup and data management platform, compromise could expose an organization's entire backup estate and facilitate lateral movement to protected systems (GitHub Advisory, Commvault Advisory).

As of the advisory date, there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.27–0.31%, placing it in roughly the 23rd percentile for exploitation probability within 30 days. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable. CVE-2026-77106 does not appear in the CISA Known Exploited Vulnerabilities catalog based on available data.

Commvault has released patched versions addressing this vulnerability: 11.36.123 or later, 11.40.72 or later, 11.44.20 or later, and 11.46.20 or later. Commvault recommends updating all installation components, including Commserve, Webserver, Command Center, Media Agents, Clients, and HyperScale X. As interim measures, administrators should restrict network access to Commvault components, enforce the principle of least privilege for user accounts, and monitor cvlaunchd logs for unauthorized command execution attempts (Commvault Advisory, GitHub Advisory).