CVE-2026-13737 is a critical flaw (CVSS 9.8 in the record, 9.2 from Commvault) in Commvault CommServe. An allowlist bypass affects authorization of command execution. Commvault says to upgrade all installations to the resolved maintenance release: 11.46.10, 11.44.11, 11.40.63 or 11.36.114 and higher.
What's affected
Commvault lists these affected and resolved versions on Linux and Windows:
- 11.46.0 through 11.46.9, resolved in 11.46.10 and higher
- 11.44.0 through 11.44.10, resolved in 11.44.11 and higher
- 11.40.0 through 11.40.62, resolved in 11.40.63 and higher
- 11.36.0 through 11.36.113, resolved in 11.36.114 and higher
Commvault says supported versions not listed are unaffected, and unsupported versions must be upgraded.
The note in the advisory about components is important. Commvault says to update all installations, naming CommServe, Webserver, Command Center, Media Agents, Clients and HyperScale X. A CommServe at the fixed level with an old media agent does not match what the advisory asks for.
How to check if you're exposed
Commvault gives these steps to verify updates. Log in to Command Center and go to Manage, then Servers (or Manage, Infrastructure, Servers). Filter servers by role, for example the Web Server role, and view updates on the server listing page. Confirm every server runs the resolved maintenance release or a higher one.
Compare each server version with the table above. Check CommServe, web servers, Command Center, media agents, clients and HyperScale X, since the advisory covers all of them.
If you are not sure which release track you are on, the major and minor numbers tell you. A 11.40 server needs 11.40.63 or higher, and moving to a different track is a separate project. Write down the track for each server before you start.
Also check which interfaces face the internet. A management server rarely needs to be reachable from outside, and a VPN or allowlist is a cheap layer.
What to do now
- List every Commvault component in your environment and its version.
- Upgrade to the resolved release for your track, 11.46.10, 11.44.11, 11.40.63 or 11.36.114, or any higher release.
- Update all installations, including CommServe, Webserver, Command Center, Media Agents, Clients and HyperScale X, as Commvault instructs.
- Confirm the update in Command Center under the server listing.
- Make sure the CommServe and Command Center are not reachable from the internet unless you have to expose them.
- Record the before and after versions for each server and keep the Command Center listing as evidence of the update.
Why it matters
Backup management servers hold the keys to your recovery data and often have wide access to production systems. A bypass of the check that decides which commands may run is a serious failure because the check is what limits who can execute what. The record lists the class as incorrect authorization and rates it as network reachable with no login and no user interaction.
The record does not flag this CVE as known exploited, and the Commvault advisory we read does not say it is. Treat the upgrade as urgent anyway, because the exposure is the management plane of your backups.
Backup platforms are attractive targets because they combine broad access with control over recovery. A flaw in command authorization needs the same urgency as one in a domain controller.
The record lists this weakness class: CWE-863 (Incorrect Authorization).
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do two scores appear?
The record carries 9.8 and Commvault states 9.2 in its advisory. Both are critical, so the action does not change.
Do unsupported versions have a fix?
Commvault says unsupported versions must be upgraded to a supported release. Only the four tracks in the table list fixed versions.
Sources
Last reviewed: 19 October 2026.
