CVE-2026-77106 is a high severity (8.8) missing authorization flaw in Commvault's Cvlaunchd that affects command execution authorization. Commvault's fix is a maintenance release: 11.46.20, 11.44.20, 11.40.72 or 11.36.123, or higher. Update every installation, not only the servers.
What's affected
The advisory title is "Cvlaunchd Code Execution". Commvault says Cvlaunchd contained a missing authorization issue affecting command execution authorization.
Commvault's advisory lists these affected versions on Linux and Windows, with the first resolved version for each:
- 11.46.0 to 11.46.19, resolved in 11.46.20 and higher
- 11.44.0 to 11.44.19, resolved in 11.44.20 and higher
- 11.40.0 to 11.40.71, resolved in 11.40.72 and higher
- 11.36.0 to 11.36.122, resolved in 11.36.123 and higher
Commvault says supported versions not listed are unaffected, and unsupported versions must be upgraded.
Where sources differ. Commvault's advisory lists a CVSS score of 7.7 and does not state the scoring version on the page. The record's score is 8.8 and Commvault's is 7.7, so here the vendor's figure is lower. Severity is High in both, and the fixed versions come from the advisory.
How to check if you're exposed
Commvault gives a way to confirm updates. Log in to Command Center, go to Manage, then Servers (or Manage, Infrastructure, Servers on newer builds), filter servers by role such as the Web Server role, and confirm every server shows the resolved maintenance release or a higher one.
Do this per server, not per environment. The advisory names which component needs the update: all Commvault installations, including CommServe, Web Server, Command Center, Media Agents, Clients and HyperScale X. Servers that are offline, in a lab or at a remote site are the ones that get missed.
What to do now
- Upgrade to a resolved maintenance release: 11.46.20, 11.44.20, 11.40.72 or 11.36.123, or higher in your line.
- Update the component named in the advisory: all Commvault installations, including CommServe, Web Server, Command Center, Media Agents, Clients and HyperScale X.
- Confirm the update from Command Center under Manage, then Servers.
- If you run an unsupported version, plan an upgrade to a supported one, since Commvault says unsupported versions must be upgraded.
- Limit network access to Commvault services to the hosts that need it while updates roll out.
Why it matters
Cvlaunchd is a launcher component, and the summary says it lacked an authorization check on command execution. That is filed under CWE-862, missing authorization. The advisory title is Code Execution.
The detail that sets this one apart is the update scope. Commvault says to update all installations, including CommServe, Web Server, Command Center, Media Agents, Clients and HyperScale X. Agents on many hosts are easy to leave behind, and any one of them can be the way in. Plan this as a fleet update, with the Command Center server list as your checklist. The record does not mark it as a CISA KEV entry.
Quick check
Is updating only the CommServe enough?
No. Commvault says to update all installations, including Web Server, Command Center, Media Agents, Clients and HyperScale X.
What is the risk?
Missing authorization on command execution, which the advisory titles Code Execution.
Sources
Last reviewed: 18 October 2026.
