CVE-2026-13737: commvault from 11.36.0 (inclusive), before 11.36.114 (exclusive), from 11.40.0 (inclusive), before 11.40.63…

Affected technology

commvault · from 11.36.0 (inclusive), before 11.36.114 (exclusive)
commvault

commvault · from 11.40.0 (inclusive), before 11.40.63 (exclusive)
commvault

commvault · from 11.44.0 (inclusive), before 11.44.11 (exclusive)
commvault

commvault · from 11.46.0 (inclusive), before 11.46.10 (exclusive)
commvault

Commvault Cloud · 11.46.0 through 11.46.9; status changes: 11.46.10 — unaffected, 11.44.0 through 11.44.10; status changes: 11.44.11 — unaffected, 11.40.0 through 11.40.62; status changes: 11.40.63 — unaffected, 11.36.0 through 11.36.113; status changes: 11.36.114 — unaffected
Commvault

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 9.2/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.