{"schema":"threatline.record/2","record":{"id":"CVE-2026-77094","aliases":[],"summary":"CvFWD Out-of-Bounds Write","details":"CvFWD contained an out-of-bounds write affecting service availability.  Software customers upgrade to resolved maintenance release. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe, Webserver, Command Center, MediaAgents, Clients and HyperScale.","categories":["Unclassified"],"product":"Commvault Cloud","vendor":"Commvault","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77094","source_modified_at":"2026-10-14T18:53:48.467Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Commvault Cloud","vendor":"Commvault","versions":[{"status":"affected","version":"11.46.0","lessThanOrEqual":"11.46.29","changes":[{"at":"11.46.30","status":"unaffected"}],"versionType":"custom"},{"status":"affected","version":"11.44.0","lessThanOrEqual":"11.44.24","changes":[{"at":"11.44.25","status":"unaffected"}],"versionType":"custom"},{"status":"affected","version":"11.40.0","lessThanOrEqual":"11.40.77","changes":[{"at":"11.40.78","status":"unaffected"}],"versionType":"custom"},{"status":"affected","version":"11.36.0","lessThanOrEqual":"11.36.126","changes":[{"at":"11.36.127","status":"unaffected"}],"versionType":"custom"}],"defaultStatus":"unknown"}],"fixed_versions":[],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00226,"percentile":0.12554,"score_date":"2026-10-23"},"published_at":"2026-10-13T14:27:00.178Z","modified_at":"2026-10-14T18:53:48.467Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-77094","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-14T18:53:48.467Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77094","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://documentation.commvault.com/securityadvisories/CV_2026_10_1.html"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-14T18:53:28.173537Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-14T18:53:48.467Z","content_hash":"936de1b0489ae1860e009142fc03b5a1fb642b503cb85ce8ae1eccd1ffd31eb8"}}