CVE-2026-77092 is a deserialization of untrusted data flaw in the Commvault Content Extractor, rated 9.8 in NVD and 7.3 high by Commvault. Fixed in maintenance releases 11.46.20, 11.44.20, 11.40.72 and 11.36.123. Upgrade to the release for your line, or higher.
What's affected
- Product: Commvault software, the Content Extractor component.
- Affected and fixed: 11.46.0 to 11.46.19 (fixed 11.46.20), 11.44.0 to 11.44.19 (fixed 11.44.20), 11.40.0 to 11.40.71 (fixed 11.40.72), and 11.36.0 to 11.36.122 (fixed 11.36.123). Platforms: Linux and Windows.
- Weakness: CWE-502, deserialization of untrusted data.
- Score: NVD lists CVSS 9.8. Commvault's advisory rates it 7.3 and calls it high. Not listed in CISA KEV.
How to check if you're exposed
Commvault documents how to verify updates. Sign in to Command Center and go to Manage, then Servers. Filter by role, for example the Web Server role, and confirm every server runs the resolved maintenance release or a higher one.
Supported versions not listed in the advisory are unaffected, and unsupported versions must be upgraded, so also find any old installs that nobody owns.
What to do now
- List every Commvault install, including older ones, and note the version.
- Upgrade to the resolved maintenance release for your line: 11.46.20, 11.44.20, 11.40.72 or 11.36.123, or higher.
- Confirm the update through Manage, then Servers in Command Center.
- Restrict network access to Command Center and related web servers to the networks that need them.
- Read the Commvault advisories issued the same day, since several components were fixed in the same maintenance releases.
Why it matters
Commvault says the Content Extractor contained a deserialization of untrusted data issue affecting privilege management. The advisory does not give more detail, and neither will this post.
Deserialization bugs matter because turning bytes back into objects can run code paths the author never intended, when the bytes come from an untrusted place. The common fix is to avoid native object deserialization for untrusted input, or restrict the types allowed. As a customer, the right move is the vendor's maintenance release.
Quick check
How serious is it?
Commvault rates it high at 7.3. NVD lists 9.8. Patch on the higher urgency.
Sources
Last reviewed: 19 October 2026.
