CVE-2026-77098: Private Metrics Server SQL Injection
Published Sep 8, 2026
·Updated
Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.
Affected Software
5 affected components
Private Metrics Server
Commvault Commvault>=11.36.0<11.36.123
Commvault Commvault>=11.40.0<11.40.72
Commvault Commvault>=11.44.0<11.44.20
Commvault Commvault>=11.46.0<11.46.20
Event History
Sep 8, 2026
CVE Published
via MITRE·12:12 PM
Data Sourced
via MITRE·12:12 PM
DescriptionWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the recommended remediation?
Upgrade Private Metrics Server to the resolved maintenance release.
2
Can affected deployments be identified by version or configuration from the available advisory data?
No. The provided data does not specify affected versions, fixed version numbers, or configuration conditions.
3
Does the available information describe temporary mitigations if an upgrade cannot be applied immediately?
No temporary workaround or compensating control is provided in the available data.