CVE-2026-13737: Command Restriction Bypass
Published Aug 11, 2026
·Updated
CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.
Affected Software
10 affected components
Commvault CommServe
Commvault Webserver
Commvault Command Center
Commvault Media Agents
Commvault Clients
Commvault HyperScale X
Commvault Commvault>=11.36.0<11.36.114
Commvault Commvault>=11.40.0<11.40.63
Commvault Commvault>=11.44.0<11.44.11
Commvault Commvault>=11.46.0<11.46.10
Event History
Aug 11, 2026
CVE Published
via MITRE·11:01 AM
Data Sourced
via MITRE·11:01 AM
DescriptionWeakness
Data Sourced
via NVD·12:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-13737?
CVE-2026-13737 has a risk score of 60, indicating a moderate severity level.
2
How do I fix CVE-2026-13737?
To resolve CVE-2026-13737, upgrade all Commvault installations to the latest maintenance release.
3
Which Commvault products are affected by CVE-2026-13737?
CVE-2026-13737 affects Commvault CommServe, Webserver, Command Center, Media Agents, Clients, and HyperScale X.
4
What type of vulnerability is CVE-2026-13737?
CVE-2026-13737 is a command restriction bypass vulnerability that affects command execution authorization.
5
When was CVE-2026-13737 published?
CVE-2026-13737 was published on August 11, 2026.