CVE-2026-77105 is a high severity (8.8) cryptographic signature verification flaw in Commvault CommServe that affects privilege management. Commvault's fix is a maintenance release: 11.46.20, 11.44.20, 11.40.72 or 11.36.123, or higher. Update CommServe and Web Server.
What's affected
The advisory title is "CommServe Privilege Escalation". Commvault says CommServe contained a cryptographic signature verification issue affecting privilege management.
Commvault's advisory lists these affected versions on Linux and Windows, with the first resolved version for each:
- 11.46.0 to 11.46.19, resolved in 11.46.20 and higher
- 11.44.0 to 11.44.19, resolved in 11.44.20 and higher
- 11.40.0 to 11.40.71, resolved in 11.40.72 and higher
- 11.36.0 to 11.36.122, resolved in 11.36.123 and higher
Commvault says supported versions not listed are unaffected, and unsupported versions must be upgraded.
Where sources differ. Commvault's advisory lists a CVSS score of 8.7 and does not state the scoring version on the page. The record's score is 8.8 and Commvault's is 8.7, so these two agree closely. Severity is High in both, and the fixed versions come from the advisory.
How to check if you're exposed
Commvault gives a way to confirm updates. Log in to Command Center, go to Manage, then Servers (or Manage, Infrastructure, Servers on newer builds), filter servers by role such as the Web Server role, and confirm every server shows the resolved maintenance release or a higher one.
Do this per server, not per environment. The advisory names which component needs the update: CommServe and Web Server. Servers that are offline, in a lab or at a remote site are the ones that get missed.
What to do now
- Upgrade to a resolved maintenance release: 11.46.20, 11.44.20, 11.40.72 or 11.36.123, or higher in your line.
- Update the component named in the advisory: CommServe and Web Server.
- Confirm the update from Command Center under Manage, then Servers.
- If you run an unsupported version, plan an upgrade to a supported one, since Commvault says unsupported versions must be upgraded.
- Limit network access to Commvault services to the hosts that need it while updates roll out.
Why it matters
Improper verification of a cryptographic signature means a check meant to prove who sent something does not hold up. It is filed under CWE-347. Commvault says the result affects privilege management, and the advisory title calls it privilege escalation.
The record's vector is network based with low privileges and high impact on all three security properties. In plain terms, an account with limited rights could end up with much more on the system that controls your backups. Pay attention to the two components in the advisory, CommServe and Web Server, and make sure both are updated. The record does not mark it as a CISA KEV entry.
Quick check
Which two components need the update?
CommServe and Web Server, according to Commvault's advisory.
Does the attacker need an account?
The record's vector requires low privileges, so a limited account is the starting point.
Sources
Last reviewed: 18 October 2026.
