{"api_version":"1","generated_at":"2026-08-24T13:31:28+00:00","cve":"CVE-2026-13737","urls":{"html":"https://cve.report/CVE-2026-13737","api":"https://cve.report/api/cve/CVE-2026-13737.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-13737","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-13737"},"summary":{"title":"Command Restriction Bypass","description":"CommServe contained an allowlist bypass vulnerability affecting command execution authorization.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.","state":"PUBLISHED","assigner":"Commvault","published_at":"2026-08-11 12:17:37","updated_at":"2026-08-11 17:17:47"},"problem_types":["CWE-863","CWE-863: Incorrect Authorization","CWE-863 CWE-863 Incorrect Authorization"],"metrics":[{"version":"4.0","source":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","type":"Secondary","score":"9.2","severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"9.2","severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","data":{"baseScore":9.2,"baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}}],"references":[{"url":"https://documentation.commvault.com/securityadvisories/CV_2026_07_8.html","name":"https://documentation.commvault.com/securityadvisories/CV_2026_07_8.html","refsource":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13737","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13737","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Commvault","product":"Commvault Cloud","version":"affected 11.46.0 11.46.9 custom","platforms":["Windows","Linux"]},{"source":"CNA","vendor":"Commvault","product":"Commvault Cloud","version":"affected 11.44.0 11.44.10 custom","platforms":["Windows","Linux"]},{"source":"CNA","vendor":"Commvault","product":"Commvault Cloud","version":"affected 11.40.0 11.40.62 custom","platforms":["Windows","Linux"]},{"source":"CNA","vendor":"Commvault","product":"Commvault Cloud","version":"affected 11.36.0 11.36.113 custom","platforms":["Windows","Linux"]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"13737","cve":"CVE-2026-13737","epss":"0.004250000","percentile":"0.351970000","score_date":"2026-08-12","updated_at":"2026-08-13 00:04:47"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-13737","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-08-11T16:48:52.032563Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-11T16:49:09.354Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unknown","platforms":["Windows","Linux"],"product":"Commvault Cloud","vendor":"Commvault","versions":[{"changes":[{"at":"11.46.10","status":"unaffected"}],"lessThanOrEqual":"11.46.9","status":"affected","version":"11.46.0","versionType":"custom"},{"changes":[{"at":"11.44.11","status":"unaffected"}],"lessThanOrEqual":"11.44.10","status":"affected","version":"11.44.0","versionType":"custom"},{"changes":[{"at":"11.40.63","status":"unaffected"}],"lessThanOrEqual":"11.40.62","status":"affected","version":"11.40.0","versionType":"custom"},{"changes":[{"at":"11.36.114","status":"unaffected"}],"lessThanOrEqual":"11.36.113","status":"affected","version":"11.36.0","versionType":"custom"}]}],"descriptions":[{"lang":"en","value":"CommServe contained an allowlist bypass vulnerability affecting command execution authorization.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X."}],"metrics":[{"cvssV4_0":{"baseScore":9.2,"baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"description":"CWE-863: Incorrect Authorization","lang":"en"}]}],"providerMetadata":{"dateUpdated":"2026-08-11T11:01:38.785Z","orgId":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","shortName":"Commvault"},"references":[{"url":"https://documentation.commvault.com/securityadvisories/CV_2026_07_8.html"}],"title":"Command Restriction Bypass"}},"cveMetadata":{"assignerOrgId":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","assignerShortName":"Commvault","cveId":"CVE-2026-13737","datePublished":"2026-08-11T11:01:38.785Z","dateReserved":"2026-06-29T14:54:15.451Z","dateUpdated":"2026-08-11T16:49:09.354Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-11 12:17:37","lastModifiedDate":"2026-08-11 17:17:47","problem_types":["CWE-863","CWE-863: Incorrect Authorization","CWE-863 CWE-863 Incorrect Authorization"],"metrics":{"cvssMetricV40":[{"source":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-11T16:48:52.032563Z","id":"CVE-2026-13737","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"13737","Ordinal":"1","Title":"Command Restriction Bypass","CVE":"CVE-2026-13737","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"13737","Ordinal":"1","NoteData":"CommServe contained an allowlist bypass vulnerability affecting command execution authorization.  Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.","Type":"Description","Title":"Command Restriction Bypass"}]}}}