Detections
Analytics

Commvault 11.36.x < 11.36.123 / 11.40.x < 11.40.72 / 11.44.x < 11.44.20 / 11.46.x < 11.46.20 Missing Authorization (CV_2026_08_8)

high Nessus Plugin ID 344811

Synopsis

The instance of Commvault installed on the remote host is affected by a vulnerability.

Description

The version of Commvault installed on the remote host is 11.36.x prior to 11.36.123, or 11.40.x prior to 11.40.72, or 11.44.x prior to 11.44.20, or 11.46.x prior to 11.46.20. It is, therefore, affected by a vulnerability as disclosed in Commvault advisory CV_2026_08_8. Cvlaunchd contained a missing authorization issue affecting command execution authorization.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to version 11.36.123, 11.40.72, 11.44.20, 11.46.20 or later.

See Also

http://www.nessus.org/u?9b075fd6

Plugin Details

Severity: High

ID: 344811

File Name: commvault_CV_2026_07_1-08_8.nasl

Version: 1.1

Type: Local

Agent: windows

Family: Windows

Published: 9/11/2026

Updated: 9/11/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.15

CVSS v2

Risk Factor: High

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-77106

CVSS v3

Risk Factor: High

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v4

Risk Factor: High

Base Score: 7.7

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/a:commvault:commvault

Required KB Items: installed_sw/Commvault

Patch Publication Date: 9/8/2026

Vulnerability Publication Date: 9/8/2026

Reference Information

CVE: CVE-2026-77106

IAVA: 2026-A-0979