Commvault: 3 CVSS 9.8 CVEs — Fixed in 11.36.123, 11.40.72, 11.44.20, 11.46.20

On September 8, 2026, Commvault published three vulnerabilities rated CVSS 9.8, all exploitable without authentication, across three distinct platform components: the Command Center, the Content Extractor and the Private Metrics Server.

Fixed versions: 11.36.123, 11.40.72, 11.44.20 and 11.46.20, depending on branch.

Individual severity isn't what makes this batch matter. It's the nature of the target: a backup platform is the one system holding a copy of everything else, and it's the first system any competent ransomware operator sets out to neutralise before triggering encryption.

The Three CVEs

All three share: CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, NVD published 2026-09-08.

None is in the CISA KEV catalog as of today — there's no publicly confirmed exploitation. That isn't a reason to wait: for this product category the gap between publication and exploitation is historically short, and Commvault has been KEV-listed before.

What the descriptions say

The vendor's wording is terse — that's the norm at Commvault:

CVE-2026-77089 — Command Center API contained an authentication bypass issue affecting privilege management.

CVE-2026-77092 — Content Extractor contained a deserialization of untrusted data issue affecting privilege management.

CVE-2026-77098 — Private Metrics Server contained an SQL injection condition affecting database operations.

No mechanism detail, no indication of prerequisites beyond the CVSS vector. I won't extrapolate what the vendor hasn't published. What the vector states with certainty: network, low complexity, no privileges, no interaction, full impact on confidentiality, integrity and availability.

Three components, three surfaces

The distribution is what deserves attention:

• Command Center is the administration interface — the console from which backup policies and restores are driven. An authentication bypass there yields control of the platform.
• Content Extractor processes the content of backed-up data for indexing and search. An untrusted deserialization in a component that, by design, processes arbitrary data coming from the systems being backed up is a particularly uncomfortable combination.
• Private Metrics Server collects telemetry. It's the least obvious component, and often the least monitored.

Three independent components hit simultaneously suggests a coordinated security review rather than three isolated discoveries.

Versions

All three CVEs are fixed by the same maintenance releases — one update covers the set.

Check your version:

Command Center → Gear icon → Maintenance → Version

Or on the CommServe server:

# Windows
Get-ItemProperty "HKLM:\SOFTWARE\CommVault Systems\Galaxy\Instance001\Base" |
  Select-Object sProductVersion, sPatchVersion

# Linux
cat /opt/commvault/Base/CVVersionInfo.xml 2>/dev/null | grep -i version

Why a Backup Platform Is a Priority Target

The order of operations in a ransomware attack

The sequence has been stable for years, and backup comes early:

1. Initial access
2. Reconnaissance — identify the backup solution
3. Privilege escalation
4. Neutralise the backups: delete restore points, shorten retention policies, encrypt or wipe repositories
5. Exfiltrate data
6. Encrypt, then demand ransom

Step 4 precedes encryption because it determines whether the victim will pay. An organisation with intact backups restores; an organisation whose backups were destroyed negotiates.

These three CVEs offer direct access to step 4, skipping steps 1 through 3.

What the platform actually holds

A compromised backup console yields far more than the ability to destroy:

• Read access to every backed-up dataset — that is, the entire information system, without having to compromise each server individually. Backup is the ideal exfiltration shortcut.
• Privileged credentials into every protected system. A backup agent has to read a server in full: those accounts are, by necessity, among the most privileged in the estate.
• The ability to restore, therefore to write, onto target systems — a payload delivery vector rarely anticipated in risk analyses.

Detection

Destructive actions inside the platform

This is the most important signal, because it's the attacker's objective:

• Deletion of backup jobs or restore points
• Retention policy changes toward shorter windows
• Deletion or dismounting of libraries and repositories
• Disabled backup plans
• Restores not tied to any request — a restore is also an exfiltration

These events are logged in the Command Center (Reports → Audit Trail). All of them should raise an alert: in a healthy organisation, deleting a restore point is a rare and documented operation.

Accounts and sessions

Command Center → Security → Users

• Unknown administrator accounts
• Recent role elevations
• Logins from unusual addresses, particularly outside business hours
• API tokens created without a request

Server logs

# CommServe
C:\Program Files\Commvault\ContentStore\Log Files\

Look for Java/.NET deserialization errors in Content Extractor logs, and abnormal SQL errors on the Private Metrics Server side — failed attempts leave traces before successful ones do.

Network exposure

# From outside the management network
nmap -Pn -p 80,443,8400,8403,81 <commserve-ip>

The Command Center should only be reachable from a restricted management network. Any broader exposure is a problem independent of these CVEs.

Mitigation

1. Apply the maintenance release for your branch

Three unauthenticated 9.8 CVEs fixed by a single update: the effort-to-benefit ratio is rarely this favourable.

2. Isolate the backup platform from the general network

This is the structural measure, and it matters well beyond these three CVEs:

• Dedicated management VLAN, unreachable from user networks
• No internet exposure, ever — neither the Command Center nor the collection components
• Administrative access from a dedicated admin workstation, not from a general-purpose desktop

3. Immutable and offline backups

No patch replaces this. An immutable copy — write-locked for a defined period, which even a compromised administrator cannot delete — is what turns a platform compromise into a recoverable incident.

The 3-2-1-1-0 rule remains the reference: 3 copies, 2 media, 1 offsite, 1 immutable or offline, 0 verification errors.

4. Strong authentication and account separation

The account administering backup should not be a domain admin account, and multi-factor authentication should be mandatory on the Command Center.

5. If you suspect a compromise

1. Verify restore point integrity before anything else — that information governs every subsequent decision
2. Isolate the platform
3. Rotate backup agent credentials: these are privileged accounts across the whole estate
4. Audit the audit trail over a wide window — backup neutralisation sometimes precedes encryption by weeks
5. Treat backed-up data as potentially exfiltrated, and handle notification obligations accordingly

Why Continuous Monitoring of Backup Infrastructure Matters

Backup infrastructure occupies a peculiar position: critical by definition, yet almost never within the scope of vulnerability scans, because it lives on a separate management network the scanners don't reach. The result is a structural blind spot over the system holding a copy of everything else.

With cveo.tech, inventory your backup platform and its components with exact versions, and get automatic alerts whenever a critical CVE affects one — regardless of what your scanners can reach.