CVE-2026-77092

Commvault's Content Extractor suffered a critical deserialization of untrusted data vulnerability affecting privilege management.

A deserialization of untrusted data flaw in Commvault's Content Extractor allowed attackers to manipulate privilege management, potentially leading to unauthorized access or data exfiltration. DIB organizations must ensure all Commvault components are patched to prevent privilege escalation and maintain compliance with NIST 800-171 controls regarding system and communications protection.

Shame score — A critical CVSS 9.8 vulnerability in a data management product used by many organizations, indicating a severe failure in secure coding practices and timely patching.