CVE-2026-97334

{
  "etk_id": "ETK-2026-1540",
  "cve_id": "CVE-2026-97334",
  "display_id": "CVE-2026-97334",
  "ghsa_id": "GHSA-6f78-rvx4-53fm",
  "euvd_id": "EUVD-2026-98764",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Decompression resource exhaustion in Commvault Cloud messaging",
  "summary": "Commvault Cloud's network messaging layer improperly handles highly compressed data, which can affect service availability. An attacker able to send such data to the affected messaging layer may cause resource exhaustion; the evidence does not establish authentication requirements.",
  "mitigation": "Upgrade all Commvault installations to the vendor's resolved maintenance release, including CommServe servers, Web Servers, Command Center, MediaAgents, clients, and HyperScale systems. Until updates are complete, restrict exposure of network messaging services to trusted hosts and networks.",
  "vendor": "Commvault",
  "product": "Commvault Cloud",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 11.46.0, <= 11.46.29",
        ">= 11.44.0, <= 11.44.24",
        ">= 11.40.0, <= 11.40.77",
        ">= 11.36.0, <= 11.36.126"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Commvault Cloud",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0036,
  "epss_percentile": 0.2783,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 55.9367388,
  "t0_at": "2026-10-13T14:27:01.613000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-13T14:27:01.613000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T14:27:01.613000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97334"
    }
  }
}