Description
The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.
Published: 2026-10-13
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an improper handling of highly compressed data in the network messaging layer that results in resource exhaustion and interrupts service availability, effectively causing a denial of service. The weakness is classified as CWE-409.

Affected Systems

The affected systems include all components of the Commvault Cloud environment: CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale. All instances running versions prior to the resolved maintenance release are susceptible.

Risk and Exploitability

The CVSS score of 8.7 categorizes this flaw as high severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog. The likely attack vector is remote traffic entering the network messaging layer. An attacker can craft highly compressed packets that force the system to decompress them, exhausting memory or processor resources and causing the services to become unavailable.

Generated by OpenCVE AI on October 13, 2026 at 17:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the resolved maintenance release on all Commvault installations, including CommServe, Web Server, Command Center, MediaAgents, clients, and HyperScale.
  • Restart each updated component to ensure the new code is active.
  • Implement network segmentation or firewall rules to limit untrusted inbound traffic to the messaging layer, reducing the attack surface until the patch is fully deployed.

Generated by OpenCVE AI on October 13, 2026 at 17:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-409
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale.
Title Network messaging layer decompression resource exhaustion
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Commvault

Published:

Updated: 2026-10-13T14:40:43.295Z

Reserved: 2026-09-24T12:01:47.252Z

Link: CVE-2026-97334

cve-icon Vulnrichment

Updated: 2026-10-13T14:40:39.676Z

cve-icon NVD

Status : Received

Published: 2026-10-13T15:17:52.300

Modified: 2026-10-13T15:17:52.300

Link: CVE-2026-97334

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T17:45:17Z

Weaknesses
  • CWE-409

    Improper Handling of Highly Compressed Data (Data Amplification)