CVE-2026-77097 is a high severity (8.2) missing authentication flaw in Commvault Private Metrics Server that affects metrics upload and availability. Commvault's fix is a maintenance release: 11.46.20, 11.44.20, 11.40.72 or 11.36.123, or higher. Update Private Metrics Server.
What's affected
The advisory title is "Private Metrics Server Denial of Service". Commvault says Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability.
Commvault's advisory lists these affected versions on Linux and Windows, with the first resolved version for each:
- 11.46.0 to 11.46.19, resolved in 11.46.20 and higher
- 11.44.0 to 11.44.19, resolved in 11.44.20 and higher
- 11.40.0 to 11.40.71, resolved in 11.40.72 and higher
- 11.36.0 to 11.36.122, resolved in 11.36.123 and higher
Commvault says supported versions not listed are unaffected, and unsupported versions must be upgraded.
Where sources differ. Commvault's advisory lists a CVSS score of 8.8 and does not state the scoring version on the page. The record's score is 8.2 and Commvault's is 8.8. Severity is High in both, and the fixed versions come from the advisory.
How to check if you're exposed
Commvault gives a way to confirm updates. Log in to Command Center, go to Manage, then Servers (or Manage, Infrastructure, Servers on newer builds), filter servers by role such as the Web Server role, and confirm every server shows the resolved maintenance release or a higher one.
Do this per server, not per environment. The advisory names which component needs the update: Private Metrics Server. Servers that are offline, in a lab or at a remote site are the ones that get missed.
What to do now
- Upgrade to a resolved maintenance release: 11.46.20, 11.44.20, 11.40.72 or 11.36.123, or higher in your line.
- Update the component named in the advisory: Private Metrics Server.
- Confirm the update from Command Center under Manage, then Servers.
- If you run an unsupported version, plan an upgrade to a supported one, since Commvault says unsupported versions must be upgraded.
- Limit network access to Commvault services to the hosts that need it while updates roll out.
Why it matters
The summary says the metrics upload function did not require authentication, which is filed under CWE-306, missing authentication for a critical function. Anyone who can reach the service over the network could use the upload function, and the stated effect is on availability.
The record's vector is network based with no privileges and no user interaction, and rates integrity impact low and availability impact high. A metrics server may feel like a minor service, but if it is on a network segment that many hosts can reach, an unauthenticated function is a real exposure. The record does not mark it as a CISA KEV entry.
Quick check
Do I need to be logged in to use the flaw?
No. The record's vector shows no privileges required, and the summary describes missing authentication on the upload function.
What does it affect?
Metrics upload functionality and service availability, per Commvault's summary.
Sources
Last reviewed: 18 October 2026.
