CVE-2026-13737

Commvault's CommServe software had an allowlist bypass vulnerability in command execution authorization.

An attacker could bypass the allowlist to execute unauthorized commands on Commvault systems, potentially leading to data theft, system compromise, or ransomware deployment. DIB organizations must ensure all Commvault components are patched immediately to prevent unauthorized access and maintain compliance with security requirements.

Shame score — A critical allowlist bypass in command execution authorization is a severe, avoidable flaw that could enable attackers to execute arbitrary commands, compromising data integrity and system security.