Description
CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
Published: 2026-10-13
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

CvFWD contained a null pointer dereference that can cause the service to crash, resulting in denial of service. This flaw arises from the software accessing data through a null reference without proper validation, making it a classic null pointer dereference (CWE-476).

Affected Systems

The flaw affects all components of Commvault Cloud—CommServe, Webserver, Command Center, MediaAgents, Clients, and HyperScale. Exact version ranges are not listed, but the advisory recommends upgrading to the latest resolved maintenance release.

Risk and Exploitability

The CVSS score of 7.1 indicates moderate severity, but the EPSS score is not available and the vulnerability is not listed in CISA KEV, leaving the exploitation probability uncertain. Based on the description, it is inferred that an attacker can trigger the flaw by sending crafted input to the CvFWD endpoint, which likely exposes a remote interface. The resulting service outage could disrupt data protection operations for affected clients.

Generated by OpenCVE AI on October 13, 2026 at 17:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest maintenance release that addresses the null pointer dereference.
  • Restart all affected Commvault components after the upgrade to ensure the fix is active.
  • Continuously monitor service logs for evidence of crashes or service interruptions.

Generated by OpenCVE AI on October 13, 2026 at 17:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.
Title CvFWD Null Pointer Dereference
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Commvault

Published:

Updated: 2026-10-14T18:52:53.868Z

Reserved: 2026-08-20T10:56:58.071Z

Link: CVE-2026-77095

cve-icon Vulnrichment

Updated: 2026-10-14T18:52:45.885Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T15:17:49.273

Modified: 2026-10-14T19:17:20.997

Link: CVE-2026-77095

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T17:45:17Z

Weaknesses