PatchSiren cyber security CVE debrief

CVE-2026-77097 Commvault CVE debrief

CVE-2026-77097 is a high-severity vulnerability affecting Commvault's Private Metrics Server, caused by a missing authentication condition. This impacts metrics upload functionality and service availability. The vulnerability has a CVSS score of 8.8. To address this issue, customers are advised to upgrade to a resolved maintenance release. The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its CVSS score and affected versions. Defenders responsible for Commvault installations, particularly those using Private Metrics Server, should assess exposure and prioritize upgrading to a resolved maintenance release. Verification of affected

Vendor: Commvault
Product: Commvault Cloud
CVSS: HIGH 8.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-09-08
Original CVE updated: 2026-09-11
Advisory published: 2026-09-08
Advisory updated: 2026-09-11

Who should care

Defenders responsible for Commvault installations, particularly those using Private Metrics Server, should assess exposure and prioritize upgrading to a resolved maintenance release.

Why it matters

CVE-2026-77097 is a high-severity vulnerability affecting Commvault's Private Metrics Server, with a CVSS score of 8.8. Defenders should prioritize upgrading to a resolved maintenance release to prevent potential service availability impacts and verify affected versions and inventory.

Service availability may be impacted due to the missing authentication condition
Metrics upload functionality may be compromised
Verification of affected versions and inventory is necessary
Upgrading to a resolved maintenance release is recommended

Technical summary

The vulnerability is caused by a missing authentication condition in Commvault's Private Metrics Server, affecting metrics upload functionality and service availability. The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its CVSS score and affected versions.

Defensive priority

Defenders should prioritize upgrading to a resolved maintenance release to prevent potential service availability impacts.

Recommended defensive actions

Upgrade to a resolved maintenance release
Review and update inventory to ensure affected versions are patched
Monitor service availability and metrics upload functionality

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its CVSS score and affected versions. Evidence is limited to public sources and may not be comprehensive. Defenders should verify affected versions and inventory, and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Sources and references

Verified primary and authoritative sources

CVE-2026-77097 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-77097

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-77097 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-77097

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://documentation.commvault.com/securityadvisories/CV_2026_08_1.html

050066fd-a2f9-4f32-ab5d-4c53f48bc333 - Vendor Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.