Commvault Unauthenticated API Access Vulnerability Allowing Unauthorized Execution of API Calls

A vulnerability exists in Commvault versions 11.32.0 through 11.32.101 and 11.36.0 through 11.36.59. The issue arises from a login mechanism that permits unauthenticated attackers to execute API calls without user credentials. While role-based access control (RBAC) can limit exposure, it does not completely eliminate the risk.

Impact

Exploitation of this vulnerability allows for unauthorized execution of API calls, potentially leading to unauthorized access or manipulation of data and functions within the Commvault environment.

Remediation

Users should upgrade to Commvault version 11.32.102 or 11.36.60, depending on their current version. Instructions for verifying if the update is installed are available in the Commvault documentation.