The vulnerability is a missing authorization check that allows an attacker to execute commands through Cvlaunchd. If the attacker can reach the affected component, they can run any command on the host, resulting in full system compromise. The CVSS score of 7.7 indicates this flaw is high severity and could yield a complete loss of confidentiality, integrity, and availability.

The flaw affects the Commvault Cloud platform. All components that host Cvlaunchd, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X, are impacted. No specific product versions were listed, so any installation of the above components may be susceptible.

The CVSS score of 7.7 reflects significant risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no currently known active exploitation. Based on the description, the likely attack vector is remote command execution through the exposed Cvlaunchd interface once an attacker gains network access to the affected services.