CVE-2026-77101

Commvault CommServe contains a stack-based buffer overflow (CWE-121) that is reachable over the network without authentication or user interaction, according to the CVSS 4.0 vector. Successful triggering of the flaw crashes or disrupts the CommServe service, producing a high impact on availability; confidentiality and integrity are not affected, so the primary gain for an attacker is denial of service against the customer's backup and data-management control plane. CommServe is the central management server in Commvault deployments, so any organization running an affected build is exposed, and an outage could stall backup, restore, and scheduling operations across the estate. As of now there is no public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS places 30-day exploitation probability at roughly 0.3% (17th percentile). The vendor states the issue is resolved in a maintenance release and directs customers to update CommServe.

What to do: Upgrade CommServe to the maintenance release identified by Commvault as containing the fix, since the advisory does not name a specific version. Until patched, restrict network access to the CommServe service to trusted management networks and monitor for service crashes or restarts. Because there are no public PoCs or known exploitation, prioritize this update within normal patching cycles rather than as an emergency.