CVE-2026-77089 is a critical authentication bypass in the Commvault Command Center API, rated 9.8 in NVD. Commvault fixed it in maintenance releases 11.46.20, 11.44.20, 11.40.72 and 11.36.123. Upgrade to the release for your line, or higher, and confirm through Command Center.
What's affected
- Product: Commvault software, the Command Center API component.
- Affected and fixed: 11.46.0 to 11.46.19 (fixed 11.46.20), 11.44.0 to 11.44.19 (fixed 11.44.20), 11.40.0 to 11.40.71 (fixed 11.40.72), and 11.36.0 to 11.36.122 (fixed 11.36.123). Platforms: Linux and Windows.
- Weakness: CWE-290, authentication bypass by spoofing.
- Score: NVD lists CVSS 9.8. Commvault's advisory rates it 9.3 and calls it critical. Not listed in CISA KEV.
How to check if you're exposed
Commvault documents how to verify updates. Sign in to Command Center and go to Manage, then Servers. Filter by role, for example the Web Server role, and confirm every server runs the resolved maintenance release or a higher one.
Supported versions not listed in the advisory are unaffected, and unsupported versions must be upgraded, so also find any old installs that nobody owns.
What to do now
- List every Commvault install, including older ones, and note the version.
- Upgrade to the resolved maintenance release for your line: 11.46.20, 11.44.20, 11.40.72 or 11.36.123, or higher.
- Confirm the update through Manage, then Servers in Command Center.
- Restrict network access to Command Center and related web servers to the networks that need them.
- Read the Commvault advisories issued the same day, since several components were fixed in the same maintenance releases.
Why it matters
The advisory is brief. It says the Command Center API contained an authentication bypass affecting privilege management, and that customers should update Command Center. It does not describe the mechanism, so this post does not guess at it.
What matters is where the component sits. Command Center is the management console for backup, so a bypass there reaches data protection itself. Backup systems are a target because they hold copies of everything and can delete them.
Quick check
Does the advisory name a workaround?
No. It says to upgrade to the resolved maintenance release.
Where do the scores come from?
NVD lists 9.8. The Commvault advisory shows 9.3. Use the vendor advisory for your risk ranking and patch either way.
Sources
Last reviewed: 19 October 2026.
