CVE-2026-13739 is a critical flaw (CVSS 9.8 in the record, 8.8 from Commvault) in Commvault Command Center. A legacy endpoint accepts arbitrary target URLs without authentication, which is server side request forgery. Update Command Center to 11.46.10, 11.44.11, 11.40.63 or 11.36.114 or higher.
What's affected
Commvault lists these affected and resolved versions on Linux and Windows:
- 11.46.0 through 11.46.9, resolved in 11.46.10 and higher
- 11.44.0 through 11.44.10, resolved in 11.44.11 and higher
- 11.40.0 through 11.40.62, resolved in 11.40.63 and higher
- 11.36.0 through 11.36.113, resolved in 11.36.114 and higher
Commvault says supported versions not listed are unaffected, and unsupported versions must be upgraded.
How to check if you're exposed
Commvault gives these steps to verify updates. Log in to Command Center and go to Manage, then Servers (or Manage, Infrastructure, Servers). Filter servers by role, for example the Web Server role, and view updates on the server listing page. Confirm every server runs the resolved maintenance release or a higher one.
Compare each server version with the table above. Check CommServe, web servers, Command Center, media agents, clients and HyperScale X, since the advisory covers all of them.
Find how Command Center is published. If it is behind a reverse proxy, look at which paths the proxy forwards and whether legacy paths are blocked. The advisory says the weak endpoint is a legacy one, so a path allowlist at the proxy is a sensible extra layer while you update.
What to do now
- Identify every Command Center instance and its version.
- Update Command Center to the resolved release for your track.
- Check that the instance is not exposed to the internet more than it must be.
- Review outbound firewall rules from the Command Center host so it can reach only what it needs.
- Look in logs for requests to legacy endpoints from unknown sources.
- Block outbound traffic from Command Center to internal ranges it does not need, so a forged request has fewer places to land.
Why it matters
Server side request forgery makes a server send requests to a destination the attacker picks. From inside your network, that can reach internal services and cloud metadata that are not exposed externally. Here the entry is an unauthenticated legacy endpoint, which is how old code paths often outlive the checks added to newer ones.
The advisory acknowledges an external researcher. The record does not flag this CVE as known exploited. Egress filtering is a helpful second layer for any web application that fetches URLs.
SSRF is dangerous mostly because of where the server sits. A server that can reach internal admin interfaces, cloud metadata or other management services becomes a way to talk to them. Limiting outbound access is a strong second defense.
The record lists this weakness class: CWE-918 (Server-Side Request Forgery (SSRF)).
Quick check
Why do the scores differ?
The record says 9.8 and the Commvault advisory says 8.8. The advisory gives the vendor view, and both call for the same update.
Is a login needed for this issue?
The record describes it as unauthenticated, so no login is needed to reach the vulnerable endpoint.
Sources
Last reviewed: 19 October 2026.
