CVE-2026-77103 is a high severity (7.5) authentication bypass in Commvault CommServe that affects access authorization and exposes information. Commvault's fix is a maintenance release: 11.46.20, 11.44.20, 11.40.72 or 11.36.123, or higher. Update CommServe.
What's affected
The advisory title is "CommServe Information Disclosure". Commvault says CommServe contained an authentication bypass issue affecting access authorization and information disclosure.
Commvault's advisory lists these affected versions on Linux and Windows, with the first resolved version for each:
- 11.46.0 to 11.46.19, resolved in 11.46.20 and higher
- 11.44.0 to 11.44.19, resolved in 11.44.20 and higher
- 11.40.0 to 11.40.71, resolved in 11.40.72 and higher
- 11.36.0 to 11.36.122, resolved in 11.36.123 and higher
Commvault says supported versions not listed are unaffected, and unsupported versions must be upgraded.
Where sources differ. Commvault's advisory lists a CVSS score of 8.7 and does not state the scoring version on the page. The record's score is 7.5 and Commvault's is 8.7. Severity is High in both, and the fixed versions come from the advisory.
How to check if you're exposed
Commvault gives a way to confirm updates. Log in to Command Center, go to Manage, then Servers (or Manage, Infrastructure, Servers on newer builds), filter servers by role such as the Web Server role, and confirm every server shows the resolved maintenance release or a higher one.
Do this per server, not per environment. The advisory names which component needs the update: CommServe. Servers that are offline, in a lab or at a remote site are the ones that get missed.
What to do now
- Upgrade to a resolved maintenance release: 11.46.20, 11.44.20, 11.40.72 or 11.36.123, or higher in your line.
- Update the component named in the advisory: CommServe.
- Confirm the update from Command Center under Manage, then Servers.
- If you run an unsupported version, plan an upgrade to a supported one, since Commvault says unsupported versions must be upgraded.
- Limit network access to Commvault services to the hosts that need it while updates roll out.
Why it matters
An authentication bypass by an alternate path means a protected function can be reached without going through the normal login step. It is filed under CWE-288. Commvault's summary says the effect is on access authorization and information disclosure, and the record's vector shows high confidentiality impact only.
CommServe holds the catalog of what you back up and how, so even read-only exposure is sensitive. It can reveal where data lives and which systems are protected. Commvault's page for this advisory also has a Mitigation section that repeats how to verify installed updates, with no separate workaround. The record does not mark it as a CISA KEV entry.
Quick check
What does the attacker get?
Information, per the record and Commvault's summary. The record shows high confidentiality impact and none on integrity or availability.
Is a separate mitigation listed?
The Mitigation section of Commvault's page covers how to verify installed updates. It lists no other workaround.
Sources
Last reviewed: 18 October 2026.
