Commvault Cloud and CVFS: OS command injection

Summary

CVFS in Commvault Cloud and Grid (HyperScale X) contains an input validation flaw (CWE-78, OS command injection) that allows command execution. The CVSS 4.0 score is 9.3 (Critical). An attacker with network access could execute commands with high impact on confidentiality, integrity and availability, and no privileges or user interaction are required. NVD analysis was still pending at the time of writing.

Affected

• Commvault Cloud 11.46.0 to 11.46.29
• Commvault Cloud 11.44.0 to 11.44.24
• Commvault Cloud 11.40.0 to 11.40.77
• Commvault Cloud 11.36.0 to 11.36.126
• Grid (HyperScale X) CVFS 5.0.1.0 to 5.0.14.4

(Ranges from the CVE record; the vendor advisory is authoritative.)

Fixed in

• Unknown for CVFS; the vendor advisory must be checked.
• Secondary source (unconfirmed): Commvault Cloud 11.36.127, 11.40.78, 11.44.25 and 11.46.30.

Workaround

Unknown. The vendor advisory is the first reference. If patching is delayed, restrict network access to Commvault management and CVFS interfaces.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact total.
• Not listed in CISA KEV at the time of writing.
• No public proof of concept found.

Our recommendation

• Identify all Commvault Cloud and CVFS installations and their versions.
• Check whether management interfaces are reachable from the internet and restrict access.
• Apply the fixed release from the vendor advisory as soon as possible, and verify the CVFS version separately.
• Check backup servers for signs of compromise.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Commvault Security Advisory CV_2026_10_9 documentation.commvault.com
• Vulners CVE-2026-77099 vulners.com
• OffSeq Radar CVE-2026-77099 radar.offseq.com
• Canadian Cyber Centre advisory mirror (AV26-1033) malware.news
• Strix CVE-2026-77099 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:21.