Commvault advisory CV_2026_10_9 fixes an input-validation flaw in CVFS (the HyperScale X / Grid storage layer) that affects command execution. The CVE record (published Oct 13) rates it CVSS 4.0 9.3 (AV:N/AC:L/PR:N/UI:N), CWE-78. Affected: Commvault Cloud on Linux 11.46.0–11.46.29, 11.44.0–11.44.24, 11.40.0–11.40.77 and 11.36.0–11.36.126, plus Grid(HSX) CVFS 5.0.1.0–5.0.14.4. Fixed in 11.46.30, 11.44.25, 11.40.78, 11.36.127 and CVFS 5.0.14.5. Patching gotcha: on 11.36 and 11.40 you must upgrade Commvault first and then CVFS separately. On 11.44+ the HyperScale X update includes CVFS. Check that every node reports the same CVFS version. Reported by JPMorgan Chase's XOR team. Not in CISA KEV and no exploitation reported, but backup platforms (including earlier Commvault bugs) are a favored ransomware target.