CVE-2026-77101 - Vulnerability Details

Description

CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.

Published: 2026-09-08

Score: 8.7 High

EPSS: < 1% Very Low

KEV: No

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Commvault

Commvault Cloud

unknown

Version	Status	Constraints
`11.46.0`	affected	≤ 11.46.19
`11.44.0`	affected	≤ 11.44.19
`11.40.0`	affected	≤ 11.40.71
`11.36.0`	affected	≤ 11.36.122

Configuration 1 [-]

AND

OR	cpe:2.3:a:commvault:commvault::::::::
	cpe:2.3:a:commvault:commvault::::::::
	cpe:2.3:a:commvault:commvault::::::::
	cpe:2.3:a:commvault:commvault::::::::

OR	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

No data.

Vendor Product Confidence Versions

Commvault

86%

Version	Status	Scheme	Platform
`[11.46.0,11.46.19]`	affected	semver	['windows', 'linux']
`[11.46.20,*]`	unaffected	semver	['windows', 'linux']
`[11.44.0,11.44.19]`	affected	semver	['windows', 'linux']
`[11.44.20,*]`	unaffected	semver	['windows', 'linux']
`[11.40.0,11.40.71]`	affected	semver	['windows', 'linux']
`[11.40.72,*]`	unaffected	semver	['windows', 'linux']
`[11.36.0,11.36.122]`	affected	semver	['windows', 'linux']
`[11.36.123,*]`	unaffected	semver	['windows', 'linux']

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00257.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://documentation.commvault.com/securityadvisories/CV_2026_08_3.html

History

Wed, 09 Sep 2026 16:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux Linux linux Kernel Microsoft Microsoft windows
CPEs		cpe:2.3:a:commvault:commvault:::::::: cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:o:microsoft:windows:-:::::::*
Vendors & Products		Linux Linux linux Kernel Microsoft Microsoft windows
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Tue, 08 Sep 2026 20:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Commvault Commvault commvault
Vendors & Products		Commvault Commvault commvault

Tue, 08 Sep 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-120

Tue, 08 Sep 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-121
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 08 Sep 2026 13:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120

Tue, 08 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		CommServe contained a stack-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.
Title		CommServe Stack-based Buffer Overflow
References		https://documentation.commvault.com/securityadvisories/CV_2026_08_3.html
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Commvault Commvault

Linux Linux Kernel

Microsoft Windows

MITRE

Status: PUBLISHED

Assigner: Commvault

Published: 2026-09-08T12:12:54.122Z

Updated: 2026-09-08T13:24:56.965Z

Reserved: 2026-08-20T10:57:52.110Z

Link: CVE-2026-77101

Vulnrichment

Updated: 2026-09-08T13:24:53.901Z

NVD

Status : Analyzed

Published: 2026-09-08T13:17:25.860

Modified: 2026-09-09T15:55:36.430

Link: CVE-2026-77101

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-10T03:15:16Z

Weaknesses

CWE-121

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object