CVE-2026-77102

CVE-2026-77102 is a heap-based buffer overflow (CWE-122) in the CommServe component of Commvault's data protection software. Per the CVSS 4.0 vector, the flaw is reachable over the network and can be triggered without authentication, without user interaction, and without special conditions. A remote attacker who sends crafted input to the affected service can corrupt heap memory and crash the CommServe process, producing a high impact on service availability but no direct loss of confidentiality or integrity. Organizations running affected CommServe maintenance releases are impacted, and the vendor has shipped a resolved maintenance release with instructions for customers to update CommServe. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days.

What to do: Upgrade CommServe to the maintenance release designated by Commvault's advisory for CVE-2026-77102 (apply the vendor's current maintenance roll-up, since specific fixed version numbers are not stated here). Until patched, restrict network access to the CommServe host so unauthenticated clients and untrusted network segments cannot reach the vulnerable service. Monitor CommServe service health and restart events, as exploitation manifests as an availability-affecting crash rather than data compromise.