CVE-2026-77091: DataCube Security Feature Bypass
Published Sep 8, 2026
·Updated
DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store.
Affected Software
4 affected components
Commvault Commvault>=11.36.0<11.36.123
Commvault Commvault>=11.40.0<11.40.72
Commvault Commvault>=11.44.0<11.44.20
Commvault Commvault>=11.46.0<11.46.20
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update DataCube components: Content Extractor and Index Store, to the resolved maintenance release to ensure the security feature enforcement bypass via path traversal is fixed.
Event History
Sep 8, 2026
CVE Published
via MITRE·12:12 PM
Data Sourced
via MITRE·12:12 PM
DescriptionWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Which components need to be updated as part of remediation?
Update both Content Extractor and Index Store, and upgrade to the resolved maintenance release.