Skip to content
COOEY

FAIL › dossier

Commvault

VENDOR

· dossier confidence 60%

Commvault Systems is a public data protection vendor headquartered in Tinton Falls, NJ, offering AI-enabled cyber resiliency solutions. Its security track record is marred by a series of high-severity RCE vulnerabilities in its Web Server and Command Center, alongside multiple concurrent flaws in its Commvault Cloud platform, indicating systemic issues in patch management and secure design.

Failure events
8
Zero-days
0
RCEs
5
On KEV
2
Critical
6
Worst shame
78
PROFILE
CategoryData Protection & Cyber Resiliency VendorWhat they doCommvault Systems provides cyber resiliency solutions for enterprises to protect, secure, and recover data, applications, and identity systems. Its flagship offering, Commvault Cloud, unifies data security, cyber recovery, and identity resilience into a single AI-enabled platform.Founded1996HQTinton Falls, New Jersey, United States Websitehttps://www.commvault.com ↗
SECURITY POSTURE

Commvault's security posture is compromised by a pattern of high-severity remote code execution (RCE) vulnerabilities in its core platforms, including the Web Server and Command Center, which have been actively exploited in the wild. The company also faces recurring multiple security flaws in its Commvault Cloud platform, requiring frequent high-priority patches across multiple version lines.

Notable failures
  • CVE-2025-3928: Authenticated RCE via Web Server webshells
  • CVE-2025-34028: Unauthenticated RCE via Command Center path traversal
  • AV26-799: Multiple high-priority security flaws in Commvault Cloud
Patterns: Repeated high-severity RCE vulnerabilities in core platform components; Multiple concurrent security flaws requiring urgent patching across version lines
FAILURE HISTORY · 14
DATEEVENTSEVSUMMARY
2026-09-08 CVE-2026-77092 critical Commvault's Content Extractor suffered a critical deserialization of untrusted data vulnerability affecting privilege management.
2026-09-08 CVE-2026-77092 critical Commvault's Content Extractor suffered a critical deserialization of untrusted data vulnerability affecting privilege management.
2025-04-28 CVE-2025-3928 high A vulnerability in Commvault's Web Server allows authenticated attackers to execute webshells remotely, actively exploited in the wild.
2026-09-08 CVE-2026-77089 critical Commvault Command Center API suffered an authentication bypass vulnerability allowing privilege escalation.
2026-09-08 CVE-2026-77098 critical Commvault's Private Metrics Server had an unpatched SQL injection flaw allowing database data disclosure.
2026-09-08 CVE-2026-77089 critical Commvault Command Center API suffered an authentication bypass vulnerability allowing privilege escalation.
2026-09-08 CVE-2026-77098 critical Commvault's Private Metrics Server had an unpatched SQL injection flaw allowing database data disclosure.
2026-08-11 CVE-2026-13738 critical Commvault's CommServe had an authorization bypass allowing limited command execution.
2026-08-11 CVE-2026-13737 critical Commvault's CommServe software had an allowlist bypass vulnerability in command execution authorization.
2026-08-11 CVE-2026-13737 critical Commvault's CommServe software had an allowlist bypass vulnerability in command execution authorization.
2026-08-11 CVE-2026-13739 critical Commvault Command Center had an unauthenticated SSRF vulnerability in a legacy endpoint.
2026-08-11 CVE-2026-13739 critical Commvault Command Center had an unauthenticated SSRF vulnerability in a legacy endpoint.
2026-08-11 CVE-2026-13738 critical Commvault's CommServe had an authorization bypass allowing limited command execution.
2025-05-02 CVE-2025-34028 high Commvault Command Center's path traversal vulnerability allows unauthenticated attackers to execute arbitrary code remotely.
DOSSIER SOURCES
Open questions: Specific patch versions for AV26-799 · Total number of employees
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-08-12 04:02:25.720682+00:00