## What Happened
Commvault disclosed three vulnerabilities affecting its enterprise data protection components. The issues include command execution authorization bypasses and a server-side request forgery (SSRF) condition. The report states there is no confirmed exploitation yet and patches are available.
## Technical Details
- CVE-2026-13737 (CVSSv4 9.2): Command restriction bypass via improper authorization validation in the CommServe component.
- CVE-2026-13738 (CVSSv4 9.2): Improper authorization validation in CommServe, enabling bypass of authorization checks for command execution.
- CVE-2026-13739 (CVSSv4 8.8): SSRF in the Command Center module due to failure to validate arbitrary target URLs correctly, enabling unauthenticated server-side requests to internal resources.
## Affected
- Product: Commvault Cloud
- Components mentioned: CommServe, Command Center, Webserver, Media Agents
- Affected release branches: 11.36, 11.40, 11.44, 11.46
- Operating systems: Windows and Linux
- Fixed versions called out:
- 11.46.10
- 11.44.11
- 11.40.63
- 11.36.114
## Impact
- Unauthorized access to core backup infrastructure through authorization bypass in CommServe.
- Potential internal network reachability via SSRF from Command Center.
- The article notes no public proof-of-concept and no evidence of active exploitation at the time of writing.
## Mitigation
1. Upgrade immediately to the resolved maintenance releases: 11.46.10, 11.44.11, 11.40.63, or 11.36.114.
2. Update all related network installations, including CommServe, Webserver, and Media Agents.
3. If patching is not possible right away, restrict network access by limiting CommServe and management interfaces to trusted administrative networks only.
4. Review and follow the official Commvault security advisories for complete remediation details.