Commvault Cloud: Resource exhaustion via decompression in network messaging layer
Summary
A flaw in the network messaging layer of Commvault Cloud allows highly compressed data to exhaust resources and degrade service availability. The vector indicates a network-reachable attack that needs no privileges and no user interaction, with impact limited to denial of service. A successful attack can block backups and restores on the affected Commvault components.
Affected
- Commvault Cloud 11.46.0 to 11.46.29
- Commvault Cloud 11.44.0 to 11.44.24
- Commvault Cloud 11.40.0 to 11.40.77
- Commvault Cloud 11.36.0 to 11.36.126
- Branches 11.42 and older are not listed in the fix table; their status is unknown.
- Vendor advisory still needs verification for component-specific details (CommServe, Web Server, Command Center, MediaAgents, clients, HyperScale).
Fixed in
- 11.36.127
- 11.40.78
- 11.44.25
- 11.46.30
- Latest maintenance release: 11.46.40 (verify in the vendor advisory).
Workaround
Unknown.
Exploitation
- No known exploitation.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
- No public proof of concept found in the research; this does not prove none exists.
Our recommendation
- Verify your Commvault versions and components against the vendor advisory CV_2026_10_3.
- Patch to the fixed build for your branch, preferably 11.46.40 or the current LTS line 11.44.
- Plan upgrades from 11.42 or older to a supported release such as 11.44.
- Restrict access to CommServe, MediaAgents and the web console to trusted networks; do not expose them to the internet.
- Monitor Commvault servers for unusual resource use until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Commvault Security Advisory CV_2026_10_3 documentation.commvault.com
- VulDB entry 417734 vuldb.com
- Vulners CVE-2026-97334 vulners.com
- Commvault release types and release tracks documentation.commvault.com
- Commvault 11.46.30 update notes documentation.commvault.com
- Strix CVE-2026-97334 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:26.
Original description (NVD)
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.