---
id: CVE-2026-77094
title: CvFWD contained an out-of-bounds write affecting service availability
summary: >-
  CvFWD contained an out-of-bounds write affecting service availability. 
  Software customers upgrade to resolved maintenance release. Software customers
  upgrade to resolved maintenance release. Update all Commvault installations,
  including…
severity: high
cwe:
  - CWE-787
published: '2026-10-13'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:17:20.883'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77094'
references:
  - url: 'https://documentation.commvault.com/securityadvisories/CV_2026_10_1.html'
    label: 050066fd-a2f9-4f32-ab5d-4c53f48bc333
tags:
  - nvd
  - cve.org
epss: 0.00226
epssPercentile: 0.1318
ingestedAt: '2026-10-13T15:33:40.081Z'
vendor: Commvault
product: Commvault Cloud
affected:
  - cloud >= 11.46.0 <= 11.46.29
  - cloud >= 11.44.0 <= 11.44.24
  - cloud >= 11.40.0 <= 11.40.77
  - cloud >= 11.36.0 <= 11.36.126
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-14T18:53:28.173537Z'
cvssSource: cna
---

## Overview

CvFWD contained an out-of-bounds write affecting service availability.  Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.