CVE-2026-77090

Awaiting Analysis Awaiting Analysis - Queue

XXE Information Disclosure Vulnerability in CVFS

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Commvault

Description

CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-77090

EUVD

EUVD-2026-98756

Affected Vendors & Products

Vendor	Product	Version / Range
Commvault	Commvault	Cloud 11.46.0
Commvault	Commvault	Cloud 11.44.0
Commvault	Commvault	Cloud 11.40.0
Commvault	Commvault	Cloud 11.36.0
Commvault	Grid(HSX)	CVFS 5.0.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

CVFS had an XML external entity (XXE) reference handling issue that could lead to information disclosure. This flaw allows attackers to access sensitive data by exploiting improper XML parsing.

Detection Guidance

Detection involves checking for XXE vulnerabilities in CVFS. Customers should verify updates by checking the Command Center or running specific commands in the HSX shell. No direct commands are provided in the resources.

Impact Analysis

An XXE vulnerability can expose confidential information, disrupt services, or lead to further attacks if exploited. Users should upgrade to the fixed maintenance release to mitigate risks.

Compliance Impact

This vulnerability could lead to information disclosure due to improper handling of XML external entities, which may expose sensitive data. Such data breaches can violate compliance requirements under GDPR and HIPAA, potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Upgrade to the resolved maintenance release of CVFS as advised by the vendor to address the XXE vulnerability.

Hi! I’m here to help you understand CVE-2026-77090. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70