---
title: Commvault CV_2026_10_9: critical CVFS command execution (CVE-2026-77099, CVSS 9.3) in Commvault Cloud and HyperScale X | ctxsec
url: https://ctxsec.com/items/commvault-cve-2026-77099
description: ""
status: "confirmed (vendor); no known exploitation"
published: 2026-10-13
---

> 

[← Cybersecurity News](/news) · [markdown](/items/commvault-cve-2026-77099.md)

confirmed (vendor); no known exploitation

2026-10-13

### Commvault CV_2026_10_9: critical CVFS command execution (CVE-2026-77099, CVSS 9.3) in Commvault Cloud and HyperScale X

Commvault advisory **CV_2026_10_9** fixes an input-validation flaw in **CVFS** (the HyperScale X / Grid storage layer) that affects command execution. The CVE record (published Oct 13) rates it CVSS 4.0 **9.3** (AV:N/AC:L/PR:N/UI:N), CWE-78. Affected: Commvault Cloud on Linux 11.46.0–11.46.29, 11.44.0–11.44.24, 11.40.0–11.40.77 and 11.36.0–11.36.126, plus Grid(HSX) CVFS 5.0.1.0–5.0.14.4. Fixed in 11.46.30, 11.44.25, 11.40.78, 11.36.127 and CVFS 5.0.14.5. **Patching gotcha:** on 11.36 and 11.40 you must upgrade Commvault first _and then_ CVFS separately. On 11.44+ the HyperScale X update includes CVFS. Check that every node reports the same CVFS version. Reported by JPMorgan Chase's XOR team. Not in CISA KEV and no exploitation reported, but backup platforms (including earlier Commvault bugs) are a favored ransomware target.

Sources: [Commvault CV_2026_10_9](https://documentation.commvault.com/securityadvisories/CV_2026_10_9.html) · [CVE-2026-77099](https://www.cve.org/CVERecord?id=CVE-2026-77099)