CVE-2026-13739

Server-Side Request Forgery (SSRF)

State: Published
Severity: 8.8 High
Published: Aug 11, 2026
Updated: Aug 11, 2026
Reserved: Jun 29, 2026

Description

A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.

Scores

CVSS	Score	Vector	Source
4.0	8.8 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N	Commvault

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
Commvault CloudCommvault	11.46.0 through 11.46.9Affectedfrom 11.46.10Not affected 11.44.0 through 11.44.10Affectedfrom 11.44.11Not affected 11.40.0 through 11.40.62Affectedfrom 11.40.63Not affected 11.36.0 through 11.36.113Affectedfrom 11.36.114Not affected

References

https://documentation.commvault.com/securityadvisories/CV_2026_07_5.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.