EXPOSURES › CVE-2026-77098
CVE-2026-77098
CRITICALCommvault's Private Metrics Server had an unpatched SQL injection flaw allowing database data disclosure.
An SQL injection vulnerability in Commvault's Private Metrics Server allowed attackers to read or modify database contents, directly impacting data integrity and confidentiality. DIB organizations must ensure all software, especially database-facing components, are patched promptly to prevent data exfiltration and compliance violations.
Shame score — A critical SQL injection flaw in a database component was left unpatched, exposing sensitive data and demonstrating a failure in timely vulnerability management.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.