CVE WatchSep 8, 2026

CVE-2026-77103

CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 8, 2026 · Last modified: Sep 8, 2026 · CWE-288

EPSS · 30d

Not enough EPSS history yet.

Technical description

CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

Official references

documentation.commvault.comhttps://documentation.commvault.com/securityadvisories/CV_2026_08_5.html

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-835278.1 HIG

—

———An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access.6h CVE-2026-626508.8 HIG

—

——0A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control (RBAC) restrictions to be bypassed through manipulation of request data. This could allow an authenticated, low-privileged remote attacker to escalate privileges to an administrative level.3h CVE-2026-761697.5 HIG

42.8%

——13fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and skipping the selected handler's normal lifecycle. An unauthenticated attacker can therefore reach an authentication-protected private fallback through an unrelated public prefix and read its full response, bypassing the authentication hook and breaking prefix encapsulation. Users should upgrade to fastify 5.12.2 or later.3h CVE-2026-629169.1 CRI

45.7%

——14Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.5h CVE-2026-847777.4 HIG

14.9%

——4Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.5d CVE-2026-811683.7 LOW

26.4%

——8Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.6d