CVE-2026-77102: High Heap Overflow in Commvault CommServe

CVE-2026-77102 is a high severity (7.5) heap-based buffer overflow in Commvault CommServe that affects service availability. Commvault's fix is a maintenance release: 11.46.20, 11.44.20, 11.40.72 or 11.36.123, or higher. Update CommServe.

What's affected

The advisory title is "CommServe Denial of Service". Commvault says CommServe contained a heap-based buffer overflow issue affecting service availability.

Commvault's advisory lists these affected versions on Linux and Windows, with the first resolved version for each:

• 11.46.0 to 11.46.19, resolved in 11.46.20 and higher
• 11.44.0 to 11.44.19, resolved in 11.44.20 and higher
• 11.40.0 to 11.40.71, resolved in 11.40.72 and higher
• 11.36.0 to 11.36.122, resolved in 11.36.123 and higher

Commvault says supported versions not listed are unaffected, and unsupported versions must be upgraded.

Where sources differ. Commvault's advisory lists a CVSS score of 8.7 and does not state the scoring version on the page. The record's score is 7.5 and Commvault's is 8.7. Severity is High in both, and the fixed versions come from the advisory.

How to check if you're exposed

Commvault gives a way to confirm updates. Log in to Command Center, go to Manage, then Servers (or Manage, Infrastructure, Servers on newer builds), filter servers by role such as the Web Server role, and confirm every server shows the resolved maintenance release or a higher one.

Do this per server, not per environment. The advisory names which component needs the update: CommServe. Servers that are offline, in a lab or at a remote site are the ones that get missed.

What to do now

1. Upgrade to a resolved maintenance release: 11.46.20, 11.44.20, 11.40.72 or 11.36.123, or higher in your line.
2. Update the component named in the advisory: CommServe.
3. Confirm the update from Command Center under Manage, then Servers.
4. If you run an unsupported version, plan an upgrade to a supported one, since Commvault says unsupported versions must be upgraded.
5. Limit network access to Commvault services to the hosts that need it while updates roll out.

Why it matters

A heap-based buffer overflow means data written into a dynamically allocated block runs past its end, filed under CWE-122. Commvault titles this advisory a denial of service, and the record's vector matches: network based, no privileges, availability impact high, nothing on confidentiality or integrity.

It is the sibling of the stack-based overflow fixed in the same release train, and the two share the same fix and the same update target. CommServe coordinates backup jobs, so keeping it available is part of keeping your data recoverable. The record does not mark it as a CISA KEV entry.

Quick check

Sources

• Commvault advisory CV_2026_08_4

Last reviewed: 18 October 2026.