An input validation flaw in Commvault CVFS allows an attacker to inject and execute arbitrary commands with the permissions of the CVFS process. By exploiting this weakness the attacker could gain full control over the affected server, enabling data exfiltration, deletion, or installation of additional malicious code, resulting in loss of confidentiality, integrity, and availability.

The vulnerability affects Commvault Cloud and Grid(HSX) CVFS products. No specific version range is listed in the advisory; customers are urged to upgrade to the resolved maintenance release released after October 9, 2026.

The CVSS score of 9.3 indicates critical severity. No EPSS score is provided, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through unsanitized input supplied to CVFS, which could be transmitted over the network or injected by a local user who has access to the CVFS service. The weakness can be leveraged only if the attacker can influence the input path to CVFS, such as by exploiting a service that forwards client data to CVFS.