CVE-2026-77098 is a SQL injection in the Commvault Private Metrics Server, rated 9.8 in NVD and 8.8 high by Commvault. Fixed in maintenance releases 11.46.20, 11.44.20, 11.40.72 and 11.36.123. Upgrade to the release for your line, or higher, then confirm in Command Center.
What's affected
- Product: Commvault software, the Private Metrics Server component.
- Affected and fixed: 11.46.0 to 11.46.19 (fixed 11.46.20), 11.44.0 to 11.44.19 (fixed 11.44.20), 11.40.0 to 11.40.71 (fixed 11.40.72), and 11.36.0 to 11.36.122 (fixed 11.36.123). Platforms: Linux and Windows.
- Weakness: CWE-89, SQL injection.
- Score: NVD lists CVSS 9.8. Commvault's advisory rates it 8.8 and calls it high. Not listed in CISA KEV.
How to check if you're exposed
Commvault documents how to verify updates. Sign in to Command Center and go to Manage, then Servers. Filter by role, for example the Web Server role, and confirm every server runs the resolved maintenance release or a higher one.
Supported versions not listed in the advisory are unaffected, and unsupported versions must be upgraded, so also find any old installs that nobody owns.
What to do now
- List every Commvault install, including older ones, and note the version.
- Upgrade to the resolved maintenance release for your line: 11.46.20, 11.44.20, 11.40.72 or 11.36.123, or higher.
- Confirm the update through Manage, then Servers in Command Center.
- Restrict network access to Command Center and related web servers to the networks that need them.
- Read the Commvault advisories issued the same day, since several components were fixed in the same maintenance releases.
Why it matters
Commvault describes an SQL injection condition in the Private Metrics Server that affects database operations. The advisory gives no more detail.
SQL injection is a long standing class, and the standard defence is parameterised queries. For you as an operator, the useful controls are the patch, limited network reach to the metrics service, and a database account with narrow rights.
Quick check
Is there a way to verify the fix?
Yes. Commvault says to use Manage, then Servers (or Manage, Infrastructure, Servers) in Command Center, filter by role, and confirm the maintenance release.
Sources
Last reviewed: 19 October 2026.
