CVE-2026-77091: Commvault DataCube Path Traversal Flaw

CVE-2026-77091 Overview

CVE-2026-77091 is a path traversal vulnerability [CWE-22] in the Commvault DataCube component. The flaw affects security feature enforcement within the Content Extractor and Index Store subsystems. An authenticated local attacker can traverse directory boundaries to reach files outside the intended scope, undermining the confidentiality, integrity, and availability guarantees of the DataCube service.

Commvault addressed the issue through maintenance releases and published guidance in security advisory CV_2026_07_3. Customers running affected versions should upgrade to the resolved maintenance release and specifically update the Content Extractor and Index Store components.

Critical Impact
A local authenticated attacker can bypass DataCube security enforcement through path traversal, reaching restricted files and compromising data protection guarantees.

Affected Products

Commvault Commvault (DataCube component)
Commvault Content Extractor
Commvault Index Store

Discovery Timeline

2026-09-08 - CVE-2026-77091 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-77091

Vulnerability Analysis

The vulnerability resides in Commvault DataCube, the platform's analytics and content indexing component. DataCube processes path input in a way that fails to fully constrain file access to the intended directory scope. As a result, the security feature that enforces access boundaries can be bypassed by an authenticated local user.

Because the affected code paths are inside the Content Extractor and Index Store, exploitation can influence how indexed and extracted content is stored, read, or referenced. That access surface makes both indexed data assets and adjacent files on the host reachable outside their intended boundaries.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The affected DataCube code accepts path components without normalizing and validating them against a canonical allow-listed root. Traversal sequences therefore resolve to file system locations outside the enforcement boundary the component is expected to protect.

Attack Vector

Exploitation requires local access and low privileges on the host running the affected Commvault components. No user interaction is required. An authenticated attacker supplies crafted path input to DataCube functionality exposed by the Content Extractor or Index Store. Because the flaw targets a security feature that gates file access, successful traversal yields read or write access to files the caller should not reach.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported at the time of writing. The CVE is not listed on the CISA Known Exploited Vulnerabilities catalog.

See the Commvault Security Advisory CV_2026_07_3 for vendor technical details.

Detection Methods for CVE-2026-77091

Indicators of Compromise

File access events from the DataCube, Content Extractor, or Index Store service accounts targeting paths outside their standard working directories.
Presence of traversal sequences such as ..\, ../, or URL-encoded equivalents (%2e%2e%2f) in DataCube request logs or job parameters.
Unexpected reads of Commvault configuration files, credential stores, or operating system files by Commvault service processes.

Detection Strategies

Enable verbose logging on the DataCube Content Extractor and Index Store, and alert on path arguments containing traversal patterns or absolute paths.
Baseline the file system access footprint of Commvault service accounts, then flag deviations that touch directories outside the indexing scope.
Correlate local authenticated sessions on Commvault hosts with subsequent DataCube activity to identify pre-exploitation reconnaissance.

Monitoring Recommendations

Forward Commvault application, audit, and Windows or Linux host telemetry to a centralized SIEM for cross-source correlation.
Monitor for privilege changes, new local accounts, or service restarts on Commvault servers following DataCube activity.
Track version and patch state of Content Extractor and Index Store to confirm remediation coverage across the estate.

How to Mitigate CVE-2026-77091

Immediate Actions Required

Upgrade Commvault to the resolved maintenance release identified in advisory CV_2026_07_3.
Update the Content Extractor and Index Store components explicitly, as noted by the vendor.
Restrict local and interactive logon to Commvault hosts to a minimal set of administrative accounts.
Audit recent DataCube activity for suspicious path input or unexpected file access.

Patch Information

Commvault has released fixed maintenance builds. Refer to the Commvault Security Advisory CV_2026_07_3 for the exact fixed versions, upgrade sequence, and post-upgrade validation steps for the Content Extractor and Index Store.

Workarounds

Limit local access to Commvault MediaAgent and Index Server hosts to trusted administrators until patching is complete.
Apply host-based access controls that constrain Commvault service accounts to their intended data directories.
Increase logging and alert thresholds on DataCube components to shorten the detection window while remediation is pending.

bash

# Configuration example
# Refer to Commvault Security Advisory CV_2026_07_3 for vendor-specified
# upgrade commands and validation steps for Content Extractor and Index Store.