CVE-2026-77090 — CVFS Information Disclosure

CVE-2026-77090

CVFS Information Disclosure PUBLISHED

Description (CNA)

CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.

Affected (CNA)

Vendor / product	Versions
Commvault / Commvault Cloud	affected 11.46.0 through 11.46.29; affected 11.44.0 through 11.44.24; affected 11.40.0 through 11.40.77; affected 11.36.0 through 11.36.126
Commvault / Grid(HSX) CVFS	affected 5.0.1.0 through 5.0.14.4

CWE

No CWE identifiers supplied.

References

https://documentation.commvault.com/securityadvisories/CV_2026_07_4.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.