The vulnerability resides in the Private Metrics Server, where a required authentication check was omitted from the metrics upload endpoint. This omission permits unauthenticated submissions to the server, which can overwhelm or crash the service, resulting in a denial of service. The flaw has the potential to disrupt metrics collection and affect overall service availability.

The affected product is Commvault Cloud’s Private Metrics Server. Specific software versions are not listed in the advisory, but all installations of this component are considered at risk until the vendor releases an updated maintenance release. Customers should verify their deployment and apply the vendor’s update as soon as it is available.

The CVSS score of 8.8 indicates a high severity impact. The exploitability of this flaw is likely remote, as the metrics upload functionality can be accessed over the network. Although an EPSS score is not available and the vulnerability is not yet listed in CISA’s KEV catalog, the missing authentication condition provides a clear attack vector for persistent, automated traffic that can exhaust service resources. Prompt remediation is advised to mitigate the risk of service disruption.