CVE-2026-97334: Network messaging layer decompression resource exhaustion

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-14
Weakness: CWE-409

Description

The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.

Affected products

Commvault Cloud: from 11.46.0 through 11.46.29; from 11.44.0 through 11.44.24; from 11.40.0 through 11.40.77; from 11.36.0 through 11.36.126

References

https://documentation.commvault.com/securityadvisories/CV_2026_10_3.html

Get alerted when CVE-2026-97334 or the next vulnerability affects your stack