CVE-2026-77094: CvFWD Out-of-Bounds Write

Severity: high (CVSS 7.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-14
Weakness: CWE-787

Description

CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.

Affected products

Commvault Cloud: from 11.46.0 through 11.46.29; from 11.44.0 through 11.44.24; from 11.40.0 through 11.40.77; from 11.36.0 through 11.36.126

References

https://documentation.commvault.com/securityadvisories/CV_2026_10_1.html

Get alerted when CVE-2026-77094 or the next vulnerability affects your stack