CVE-2026-97334: Commvault Network Messaging DoS Vulnerability

CVE-2026-97334 Overview

CVE-2026-97334 is a denial of service vulnerability in the Commvault network messaging layer. The flaw stems from improper handling of highly compressed data, classified under [CWE-409] (Improper Handling of Highly Compressed Data, also known as a data amplification or decompression bomb issue). A remote, unauthenticated attacker can send crafted compressed payloads to a Commvault service and exhaust resources, disrupting availability. Commvault published advisory CV_2026_10_3 and released a resolved maintenance update covering CommServe server, Web Server, Command Center, MediaAgents, clients, and HyperScale deployments.

Critical Impact
Remote unauthenticated attackers can trigger service availability loss across core Commvault backup and recovery infrastructure.

Affected Products

Commvault CommServe server, Web Server, and Command Center
Commvault MediaAgents and clients
Commvault HyperScale appliances

Discovery Timeline

2026-10-13 - CVE-2026-97334 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-97334

Vulnerability Analysis

The vulnerability resides in the network messaging layer that Commvault components use for inter-service communication. The messaging layer decompresses inbound payloads without enforcing sufficient size or ratio limits on the resulting data. A small compressed input can expand into a disproportionately large in-memory structure, consuming memory and processor resources on the receiving service.

The weakness maps to [CWE-409]. These issues are commonly described as decompression bombs. The attack surface spans every Commvault role that terminates the messaging protocol, including CommServe, Web Server, Command Center, MediaAgents, and client agents.

Successful exploitation disrupts backup, restore, and management workflows. Because Commvault handles data protection, loss of availability can delay recovery operations during an incident and widen the blast radius of concurrent attacks.

Root Cause

The service accepts compressed messages and allocates buffers based on the decompressed payload rather than validating a bounded maximum. Missing checks on expansion ratio, decompressed length, and resource consumption allow a crafted payload to drive memory or CPU exhaustion before the parser can reject the input.

Attack Vector

The attack vector is network based and requires no authentication or user interaction. An attacker with reachability to a Commvault service port sends one or more crafted compressed messages. The affected service decompresses the data and exhausts resources, degrading or stopping the service. See the Commvault Security Advisory CV_2026_10_3 for vendor technical details.

Detection Methods for CVE-2026-97334

Indicators of Compromise

Sudden memory or CPU spikes on CommServe, MediaAgent, Web Server, or Command Center processes without a corresponding backup workload.
Service crashes, restarts, or out-of-memory events in Commvault logs following inbound connections from untrusted sources.
Repeated short-lived TCP sessions to Commvault service ports from a single external or internal source.

Detection Strategies

Correlate process restart events on Commvault hosts with network flow data to identify suspicious inbound sources.
Alert on anomalous ratios between inbound byte counts and resulting resource consumption on backup infrastructure.
Monitor Commvault application logs for parser or decompression errors referencing oversized or malformed messages.

Monitoring Recommendations

Baseline normal connection patterns to Commvault service ports and alert on deviations from trusted MediaAgent and client sources.
Ingest Commvault service and system logs into a centralized analytics platform for correlation across the backup fabric.
Track service availability of CommServe, Web Server, and MediaAgent roles with synthetic health checks.

How to Mitigate CVE-2026-97334

Immediate Actions Required

Apply the resolved maintenance release from Commvault to all CommServe, Web Server, Command Center, MediaAgent, client, and HyperScale installations.
Restrict network reachability to Commvault service ports so that only authorized backup infrastructure can connect.
Review Commvault logs for signs of resource exhaustion or repeated service restarts prior to patching.

Patch Information

Commvault addressed CVE-2026-97334 in the resolved maintenance release referenced in advisory CV_2026_10_3. Customers should upgrade every Commvault component in the environment, since the messaging layer is shared across roles. Refer to the Commvault Security Advisory CV_2026_10_3 for exact fixed versions and upgrade guidance.

Workarounds

Enforce network segmentation and firewall rules that limit access to Commvault service ports to known management subnets and backup clients.
Place Commvault management interfaces behind a VPN or jump host to remove exposure to broad network segments.
Monitor and rate-limit traffic to Commvault services at the perimeter where feasible until patching is complete.

bash

# Example: restrict access to Commvault services to a trusted management subnet
# Replace 10.10.20.0/24 with your authorized backup management range
iptables -A INPUT -p tcp -m multiport --dports 8400:8403 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports 8400:8403 -j DROP