VulnerabilityAwaiting Analysis

CVE-2026-77094

CvFWD contained an out-of-bounds write affecting service availability.

HIGH 7.1EPSS 0.23%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.

CVSS 4.0: 7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.23% probability · 13th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-787
Source: 050066fd-a2f9-4f32-ab5d-4c53f48bc333

EPSS trend

EPSS moved from 0.2% on 14 October 2026 to 0.2% on 26 October 2026.

References

https://documentation.commvault.com/securityadvisories/CV_2026_10_1.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.