CVFS contained a missing authentication condition that allows entities to execute arbitrary commands. This flaw enables an attacker to invoke CVFS commands without proper authentication, providing the potential for command injection or full control over the underlying system. The vulnerability is classified with a CVSS score of 7.7, indicating high severity.

The flaw affects Commvault Cloud and the Grid(HSX) CVFS component. No specific product versions are listed, so all deployments of these components are potentially impacted until the maintenance release is applied.

Based on the description, it is inferred that the missing authentication allows an attacker to trigger the flaw likely through unauthenticated or delegated access to CVFS API endpoints. The EPSS score is less than 1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The CVSS of 7.7 indicates a high severity. No specific environmental prerequisites are listed, implying that the vulnerability can be triggered in any environment where CVFS is exposed.