EXPOSURES › CVE-2026-13738
CVE-2026-13738
CRITICALCommvault's CommServe had an authorization bypass allowing limited command execution.
An authorization bypass in Commvault's CommServe allowed attackers to execute limited commands without proper authentication, violating the principle of least privilege. DIB organizations must ensure all Commvault components are patched to prevent unauthorized access and maintain compliance with NIST 800-171 access control requirements.
Shame score — A critical authorization bypass in a data management platform that could be exploited to execute commands, indicating a significant failure in access control design.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.