{"api_version":"1","generated_at":"2026-10-14T08:40:39+00:00","cve":"CVE-2026-77094","urls":{"html":"https://cve.report/CVE-2026-77094","api":"https://cve.report/api/cve/CVE-2026-77094.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-77094","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-77094"},"summary":{"title":"CvFWD Out-of-Bounds Write","description":"CvFWD contained an out-of-bounds write affecting service availability.  Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.","state":"PUBLISHED","assigner":"Commvault","published_at":"2026-10-13 15:17:49","updated_at":"2026-10-13 15:17:49"},"problem_types":["CWE-787: Out-of-bounds Write"],"metrics":[{"version":"4.0","source":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","type":"Secondary","score":"7.1","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"7.1","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","data":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}}],"references":[{"url":"https://documentation.commvault.com/securityadvisories/CV_2026_10_1.html","name":"https://documentation.commvault.com/securityadvisories/CV_2026_10_1.html","refsource":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77094","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77094","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Commvault","product":"Commvault Cloud","version":"affected 11.46.0 11.46.29 custom","platforms":["Windows","Linux"]},{"source":"CNA","vendor":"Commvault","product":"Commvault Cloud","version":"affected 11.44.0 11.44.24 custom","platforms":["Windows","Linux"]},{"source":"CNA","vendor":"Commvault","product":"Commvault Cloud","version":"affected 11.40.0 11.40.77 custom","platforms":["Windows","Linux"]},{"source":"CNA","vendor":"Commvault","product":"Commvault Cloud","version":"affected 11.36.0 11.36.126 custom","platforms":["Windows","Linux"]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase.","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unknown","platforms":["Windows","Linux"],"product":"Commvault Cloud","vendor":"Commvault","versions":[{"changes":[{"at":"11.46.30","status":"unaffected"}],"lessThanOrEqual":"11.46.29","status":"affected","version":"11.46.0","versionType":"custom"},{"changes":[{"at":"11.44.25","status":"unaffected"}],"lessThanOrEqual":"11.44.24","status":"affected","version":"11.44.0","versionType":"custom"},{"changes":[{"at":"11.40.78","status":"unaffected"}],"lessThanOrEqual":"11.40.77","status":"affected","version":"11.40.0","versionType":"custom"},{"changes":[{"at":"11.36.127","status":"unaffected"}],"lessThanOrEqual":"11.36.126","status":"affected","version":"11.36.0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"reporter","value":"Michael Tucker and Tan Chew Keong from the XOR team at JPMorgan Chase."}],"descriptions":[{"lang":"en","value":"CvFWD contained an out-of-bounds write affecting service availability.  Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale."}],"metrics":[{"cvssV4_0":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"description":"CWE-787: Out-of-bounds Write","lang":"en"}]}],"providerMetadata":{"dateUpdated":"2026-10-13T14:27:00.178Z","orgId":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","shortName":"Commvault"},"references":[{"url":"https://documentation.commvault.com/securityadvisories/CV_2026_10_1.html"}],"title":"CvFWD Out-of-Bounds Write"}},"cveMetadata":{"assignerOrgId":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","assignerShortName":"Commvault","cveId":"CVE-2026-77094","datePublished":"2026-10-13T14:27:00.178Z","dateReserved":"2026-08-20T10:56:58.071Z","dateUpdated":"2026-10-13T14:27:00.178Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-13 15:17:49","lastModifiedDate":"2026-10-13 15:17:49","problem_types":["CWE-787: Out-of-bounds Write"],"metrics":{"cvssMetricV40":[{"source":"050066fd-a2f9-4f32-ab5d-4c53f48bc333","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"77094","Ordinal":"1","Title":"CvFWD Out-of-Bounds Write","CVE":"CVE-2026-77094","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"77094","Ordinal":"1","NoteData":"CvFWD contained an out-of-bounds write affecting service availability.  Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.","Type":"Description","Title":"CvFWD Out-of-Bounds Write"}]}}}