CVE-2026-13738 is a critical flaw (CVSS 9.8) in Commvault CommServe. An authorization bypass affects a limited set of command execution operations. Commvault says to upgrade every installation to the resolved maintenance release: 11.46.10, 11.44.11, 11.40.63 or 11.36.114 and higher, depending on your track.
What's affected
Commvault lists these affected and resolved versions on Linux and Windows:
- 11.46.0 through 11.46.9, resolved in 11.46.10 and higher
- 11.44.0 through 11.44.10, resolved in 11.44.11 and higher
- 11.40.0 through 11.40.62, resolved in 11.40.63 and higher
- 11.36.0 through 11.36.113, resolved in 11.36.114 and higher
Commvault says supported versions not listed are unaffected, and unsupported versions must be upgraded.
How to check if you're exposed
Commvault gives these steps to verify updates. Log in to Command Center and go to Manage, then Servers (or Manage, Infrastructure, Servers). Filter servers by role, for example the Web Server role, and view updates on the server listing page. Confirm every server runs the resolved maintenance release or a higher one.
Compare each server version with the table above. Check CommServe, web servers, Command Center, media agents, clients and HyperScale X, since the advisory covers all of them.
Write down the track for each server before you start. A 11.36 server needs 11.36.114 or higher, and a move to a newer track is a separate project with its own planning. Check Command Center for any servers that show an older version than the rest, which are the ones most often forgotten.
What to do now
- Inventory Commvault servers and note each version.
- Move each to the resolved release for its track, or a higher one.
- Update every component Commvault lists, not just the CommServe.
- Verify through Command Center that all servers show the new version.
- Review who can reach the management interfaces and narrow it.
- Keep Command Center server listing screenshots or exports as evidence of the update.
Why it matters
Authorization checks decide who may do what. When one is bypassed for certain command operations, a caller without the right can run actions meant for administrators. The record lists incorrect authorization as the weakness class, reachable over the network without login or user interaction.
Commvault describes the scope as a limited set of operations, but the impact ratings in the record are high for confidentiality, integrity and availability, which fits a system that controls backups. Neither the record nor the advisory flags the issue as known exploited.
When two critical advisories ship for one product on the same day, as here, treat them as one project. One maintenance upgrade closes the CVE-2026-13737 allowlist bypass and this authorization bypass, and the SSRF in Command Center, if you reach the fixed level on every component.
The record lists this weakness class: CWE-863 (Incorrect Authorization).
Quick check
Is this the same bug as CVE-2026-13737?
No. Commvault published it as a separate advisory, CV_2026_07_9, with its own description. The affected and fixed versions match, so one upgrade covers both.
Will one upgrade fix all three Commvault CVEs from August?
The affected and fixed versions in the three advisories match, so reaching the resolved release on every component covers CVE-2026-13737, CVE-2026-13738 and CVE-2026-13739. Confirm against each advisory.
Sources
Last reviewed: 19 October 2026.
