Commvault Command Center API Authentication Bypass

Overview

• CVE: CVE-2026-77089

• Severity: Critical

• CVSS: 9.3

• Date: 10 September 2026

• Affected product: Commvault Command Center API on Linux and Windows

Commvault has identified a critical authentication bypass in the Command Center API that affects privilege management. The vendor has released resolved maintenance versions for affected Commvault branches and advises customers to update Command Center.

Affected Versions

Commvault 11.46

• Affected: 11.46.0 to 11.46.19

• Fixed: 11.46.20 and higher

• Not affected: Supported versions not listed by Commvault

• Source: Commvault Security Advisory CV_2026_07_1

Commvault 11.44

• Affected: 11.44.0 to 11.44.19

• Fixed: 11.44.20 and higher

• Not affected: Supported versions not listed by Commvault

• Source: Commvault Security Advisory CV_2026_07_1

Commvault 11.40

• Affected: 11.40.0 to 11.40.71

• Fixed: 11.40.72 and higher

• Not affected: Supported versions not listed by Commvault

• Source: Commvault Security Advisory CV_2026_07_1

Commvault 11.36

• Affected: 11.36.0 to 11.36.122

• Fixed: 11.36.123 and higher

• Not affected: Supported versions not listed by Commvault

• Source: Commvault Security Advisory CV_2026_07_1

Unsupported Commvault versions must be upgraded. Commvault states that supported versions not listed in the advisory are unaffected.

Vulnerability Breakdown

CVE-2026-77089 - Command Center API Authentication Bypass

• Severity: Critical

• CVSS: 9.3

• Description: The Command Center API contains an authentication bypass issue affecting privilege management.

• Impact: The vendor classifies the issue as critical.

• Conditions: The vendor advisory does not specify additional exploitation prerequisites.

• Affected platforms: Linux and Windows

• Source: Commvault Security Advisory CV_2026_07_1

  
  

Mitigation

• Upgrade each affected Commvault branch to its resolved maintenance release or higher.

• Update Command Center.

• In Command Center, go to Manage > Servers, filter for the relevant role, such as Web Server, and confirm all servers are running the resolved maintenance release or higher.

• Upgrade unsupported versions to a supported release.

  
  

Summary for IT Teams

• Products: Commvault Command Center API on Linux and Windows

• Threat Level: Critical, CVSS 9.3

• Action Required: Update 11.36 to 11.36.123 or higher, 11.40 to 11.40.72 or higher, 11.44 to 11.44.20 or higher, and 11.46 to 11.46.20 or higher, as applicable. Verify updates in Command Center.

Reference

• Commvault Security Advisory CV_2026_07_1

  
  

Need Help?

Please get in touch on 1300 769 460 or email us. We are here to help you strengthen your cybersecurity posture.