CVE-2026-13739

Commvault Command Center had an unauthenticated SSRF vulnerability in a legacy endpoint.

An unauthenticated server-side request forgery (SSRF) flaw in Commvault Command Center allowed attackers to send arbitrary requests to internal systems, risking data exfiltration and lateral movement. DIB organizations must ensure legacy endpoints are patched and monitored, as unauthenticated SSRF can bypass perimeter defenses and lead to compliance violations under NIST 800-171. Update Command Center immediately to resolve this critical vulnerability.

Shame score — A critical CVSS 9.8 SSRF vulnerability existed in a legacy endpoint without authentication, indicating poor endpoint lifecycle management and leaving systems exposed to exploitation.