CVE-2026-77090
Received Received - Intake

XXE Information Disclosure Vulnerability in CVFS

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Commvault

Description
CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved maintenance release. Update CVFS.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-77090
EUVD
EUVD-2026-98756

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Commvault Commvault Cloud 11.46.0
Commvault Commvault Cloud 11.44.0
Commvault Commvault Cloud 11.40.0
Commvault Commvault Cloud 11.36.0
Commvault Grid(HSX) CVFS 5.0.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVFS had an XML external entity (XXE) reference handling issue that could lead to information disclosure. This flaw allows attackers to access sensitive data by exploiting improper XML parsing.

Detection Guidance

Detection involves checking for XXE vulnerabilities in CVFS. Customers should verify updates by checking the Command Center or running specific commands in the HSX shell. No direct commands are provided in the resources.

Impact Analysis

An XXE vulnerability can expose confidential information, disrupt services, or lead to further attacks if exploited. Users should upgrade to the fixed maintenance release to mitigate risks.

Compliance Impact

This vulnerability could lead to information disclosure due to improper handling of XML external entities, which may expose sensitive data. Such data breaches can violate compliance requirements under GDPR and HIPAA, potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Upgrade to the resolved maintenance release of CVFS as advised by the vendor to address the XXE vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77090. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart