Description
Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.
Published: 2026-09-08
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Bypass / Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability in the Command Center API permits an attacker to bypass authentication controls, allowing unauthorized privileged operations. This flaw can give attackers full administrative control over the affected system, potentially compromising confidentiality, integrity, and availability.

Affected Systems

Commvault Cloud Command Center, the central management component of Commvault Cloud, is impacted. No specific version range is listed in the advisory, but the issue applies to any instance that has not applied the resolved maintenance release referenced by Commvault.

Risk and Exploitability

With a CVSS score of 9.3 the vulnerability is classified as critical. The EPSS score is 0.0033 (less than 1%) and it is not listed in the CISA KEV catalog. The likely attack vector is over the network through the Command Center API; based on the description it is inferred that an attacker could send crafted API requests that bypass authentication, enabling privileged actions without valid credentials.

Generated by OpenCVE AI on September 10, 2026 at 05:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the resolved maintenance release for Commvault Cloud Command Center to eliminate the authentication bypass.
  • Update custom integrations or automation scripts to point to the patched API endpoints and enforce the new authentication mechanisms.
  • Review privileged API access logs for suspicious activity and consider disabling or hardening unused privileged endpoints until the patch is fully deployed.

Generated by OpenCVE AI on September 10, 2026 at 05:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Thu, 10 Sep 2026 04:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-285
CWE-294

Wed, 09 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-290
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Commvault
Commvault commvault
Vendors & Products Commvault
Commvault commvault

Tue, 08 Sep 2026 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-285
CWE-294

Tue, 08 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Description Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.
Title Command Center API Authentication Bypass
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Commvault Commvault
cve-icon MITRE

Status: PUBLISHED

Assigner: Commvault

Published:

Updated: 2026-09-09T12:34:01.813Z

Reserved: 2026-08-20T10:56:18.889Z

Link: CVE-2026-77089

cve-icon Vulnrichment

Updated: 2026-09-09T10:13:33.424Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-08T13:17:25.227

Modified: 2026-09-11T14:25:43.913

Link: CVE-2026-77089

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T05:30:16Z

Weaknesses
  • CWE-290

    Authentication Bypass by Spoofing