CVE-2026-13737 — Command Restriction Bypass

CVE-2026-13737

Command Restriction Bypass PUBLISHED

Description (CNA)

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

Affected (CNA)

Vendor / product	Versions
Commvault / Commvault Cloud	affected 11.46.0 through 11.46.9; affected 11.44.0 through 11.44.10; affected 11.40.0 through 11.40.62; affected 11.36.0 through 11.36.113

CWE

No CWE identifiers supplied.

References

https://documentation.commvault.com/securityadvisories/CV_2026_07_8.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.