Commvault Cloud/CVFS: XML external entity issue leads to information disclosure

Summary

Commvault Cloud and the Commvault File System (CVFS) in HyperScale X contain an XML external entity (XXE) reference handling issue. A network-reachable attacker without credentials or user interaction could potentially read limited information from affected systems, such as backup metadata or credentials. The vendor and CNA data list the impact as high for confidentiality only, with no integrity or availability impact.

Affected

• Commvault Cloud: 11.46.0 to 11.46.29, 11.44.0 to 11.44.24, 11.40.0 to 11.40.77, 11.36.0 to 11.36.126
• Grid(HSX) CVFS: 5.0.1.0 to 5.0.14.4
• Open point: 11.38 appears in a third-party source but not in the CVE record. Confirm with the vendor.

Fixed in

• Commvault Cloud: 11.46.30 or later, 11.44.25 or later, 11.40.78 or later (third-party source, verify with vendor advisory)
• CVFS: 5.0.14.5 or later (third-party source, verify with vendor advisory)
• 11.36 branch: Unknown.
• No HyperScale X platform release with CVFS 5.0.14.5 confirmed.

Workaround

• Unknown. No vendor-published mitigation for the XML parsing issue found.
• Generic hardening: restrict Commvault management and web interfaces to internal networks or VPN.

Exploitation

• No evidence of exploitation found at the time of research.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• EPSS score 0.0033. No public proof of concept found.
• Check the CISA KEV catalog directly.

Our recommendation

• Inventory Commvault Cloud and HyperScale X/CVFS versions in Command Center.
• Check the vendor advisory for the confirmed fixed builds, including 11.36 and 11.38 status.
• Patch to the vendor-listed fixed maintenance release. According to a third-party guide, update Commvault Cloud first, then CVFS, on affected 11.36 and 11.40 systems.
• Restrict exposure of Commvault management and web interfaces.
• Monitor backup systems for unusual access.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Commvault Security Advisory CV_2026_07_4 documentation.commvault.com
• Vulners CVE-2026-77090 vulners.com
• CyStack Commvault Cloud vulnerability database cystack.net
• Strix CVE-2026-77090 www.strix.ai
• IMFHT patch guide CVE-2026-77090 cve.imfht.com
• Commvault HyperScale X Platform Release 3.2606 documentation docs.commvault.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:27.