CVE-2026-77090

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Oct 13, 2026
Source updated: Oct 14, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

CVFS Information Disclosure

CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Commvault Cloud

Vendor: Commvault
Product: Commvault Cloud
Platforms: Linux
Default status: unknown

Commvault Cloud · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
11.46.0	`affected`	custom	Unavailable	11.46.29	`11.46.30` → `unaffected`
11.44.0	`affected`	custom	Unavailable	11.44.24	`11.44.25` → `unaffected`
11.40.0	`affected`	custom	Unavailable	11.40.77	`11.40.78` → `unaffected`
11.36.0	`affected`	custom	Unavailable	11.36.126	`11.36.127` → `unaffected`

Grid(HSX) CVFS

Vendor: Commvault
Product: Grid(HSX) CVFS
Platforms: Linux
Default status: unknown

Grid(HSX) CVFS · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
5.0.1.0	`affected`	custom	Unavailable	5.0.14.4	`5.0.14.5` → `unaffected`