CVE-2026-13738Improper Authorization Validation

9.2CriticalCVSS base score
0.67%Exploitation in 30 daysEPSS · top 47% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

Timeline

2026
29 Jun 2026
29 Jun 2026
ID reserved
By Commvault
11 Aug 202643 days later
11 Aug 2026· 43 days later
Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-13738, by who scored it
Scored by	CVSS	Score	Vector
CommvaultCNA (assigner)	4.0	Critical9.2	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
NVDNVD · Analyzed	4.0	Critical9.2	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.67% · top 47% of all CVEs (13 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.2.

Affected products

Commvault · Commvault Cloud
- affected 11.46.0 – ≤ 11.46.9
- affected 11.44.0 – ≤ 11.44.10
- affected 11.40.0 – ≤ 11.40.62
- affected 11.36.0 – ≤ 11.36.113

References1

https://documentation.commvault.com/securityadvisories/CV_2026_07_9.html (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-13738](https://cveledger.app/badge/CVE-2026-13738.svg)](https://cveledger.app/cve/CVE-2026-13738)

Record last updated 11 Aug 2026, 16:48 UTC.