Commvault Backup & Recovery

Name: Commvault Backup & Recovery
Brand: Commvault

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

unpatched

by severity

3critical2high3medium0low

updated 2026-10-27

vulnerabilities (10)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-14847US	—OT critical	83.2% (100th)	KEV	11.32.129	2025-12-19	3 versions
CVE-2025-3928US	high8.8OT critical	2.53% (85th)	KEV	11.28.141	2025-04-25	4 versions
CVE-2025-57790US	high8.8	43.9% (99th)	Exploit	11.36.60	2025-08-20	2 versions
CVE-2025-57791US	medium6.5	38.8% (99th)	Exploit	11.36.60	2025-08-20	2 versions
CVE-2025-57788US	medium6.5OT elevated	7.76% (95th)	Exploit	11.36.60	2025-08-20	2 versions
CVE-2025-57789US	medium5.4	1.23% (69th)	—	11.32.102	2025-08-20	2 versions
CVE-2026-13738US	critical9.8OT elevated	0.67% (52nd)	—	11.36.114	2026-08-11	4 versions
CVE-2026-13737US	critical9.8OT elevated	0.67% (52nd)	—	11.46.10	2026-08-11	4 versions
CVE-2025-34136US	—	0.53% (45th)	—	11.32.94	2025-07-25	3 versions
CVE-2026-13739US	critical9.8	0.48% (41st)	—	11.46.10	2026-08-11	4 versions

The flaw types (CWEs) most of these CVEs share.

CWE-863Incorrect Authorization2 CVEs
CWE-130Improper Handling of Length Parameter Inconsistency1 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-23Relative Path Traversal1 CVEs
CWE-257Storing Passwords in a Recoverable Format1 CVEs
CWE-259Use of Hard-coded Password1 CVEs
CWE-36Absolute Path Traversal1 CVEs
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.