CVE-2026-77091 Commvault CVE debrief

Who should care

Commvault system administrators and security teams should assess exposure and prioritize upgrading to a resolved maintenance release. They should review and verify Commvault system configurations, and check relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

CVE-2026-77091 is a path traversal issue affecting Commvault's security feature enforcement, with a CVSS score of 8.5 and HIGH severity. Defenders should prioritize upgrading to a resolved maintenance release and updating Content Extractor and Index Store to prevent potential security risks.

• Potential security risks due to path traversal issue
• Need to upgrade to a resolved maintenance release
• Need to update Content Extractor and Index Store

Technical summary

CVE-2026-77091 is a path traversal issue affecting Commvault's security feature enforcement. The issue has a CVSS score of 8.5 and is considered HIGH severity. The vulnerability allows attackers to traverse the file system, potentially leading to security risks. Commvault system administrators and security teams should assess exposure and prioritize upgrading to a resolved maintenance release and updating Content Extractor and Index Store.

Defensive priority

Defenders should prioritize upgrading to a resolved maintenance release and updating Content Extractor and Index Store to prevent potential security risks.

Recommended defensive actions

• Upgrade to a resolved maintenance release
• Update Content Extractor and Index Store
• Review and verify Commvault system configurations

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the path traversal issue affecting Commvault's security feature enforcement. The issue has a CVSS score of 8.5 and is considered HIGH severity. The vulnerability allows attackers to traverse the file system, potentially leading to security risks. Defenders should verify the affected scope, severity, and vendor guidance. The official CVE Program record and NIST NVD detail page offer source-provided CVE metadata and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.