Skip to content
Edition of Sunday, November 8, 2026
Daily CISO

The five-minute briefing for security leaders.

Security vendor · Backup and cyber recovery · in CISA KEV

Commvault in the CISA KEV catalog

CISA’s Known Exploited Vulnerabilities catalog lists 2 entries for Commvault as of catalog version 2026.11.06, released November 6, 2026. The newest was added May 2, 2025, and the latest federal due date is May 23, 2025.

Updated

entries in the catalog
2
newest addition
May 2, 2025
latest federal due date
May 23, 2025
marked known ransomware use
0

Directory record

Website
www.commvault.com
Categories
Backup and cyber recovery (primary), Directory backup and recovery
Headquarters
Tinton Falls, United States
Founded
Not established
Ownership
Public (NASDAQ: CVLT)
Company record
Commvault on CISO Tribune

Directory data as of November 8, 2026. What the company sells, and the source for every fact, is on its CISO Tribune page.

KEV entries, newest first

Filed by CISA under the name “Commvault”. Each row links to the CVE’s NVD record; entries added in the last 45 days also link to their place on must-patch. The due date is CISA’s remediation deadline for federal civilian agencies, as the feed states it.

  1. Added May 2, 2025

    CVE-2025-34028 Commvault Command Center Path Traversal Vulnerability

    Command Center

    Due May 23, 2025

  2. Added April 28, 2025

    CVE-2025-3928 Commvault Web Server Unspecified Vulnerability

    Web Server

    Due May 19, 2025

Snapshot of CISA’s feed taken November 7, 2026; the whole catalog is counted on the KEV tracker.

On Daily CISO, newest first

  1. Weekly archive · Aug 18 – Aug 24, 2025

    Commvault Patches Four Flaws Enabling Remote Code Execution

  2. Weekly archive · May 19 – May 25, 2025

    CISA Details Threat Activity Against Commvault's Metallic SaaS Backup

  3. Weekly archive · Mar 31 – Apr 6, 2025

    ESET and Commvault Name New Security Executives

Sources

  1. Cybersecurity and Infrastructure Security Agency, KEV catalog · primary source
  2. Cybersecurity and Infrastructure Security Agency, KEV JSON feed (catalog version 2026.11.06), published November 6, 2026 · primary source
  3. CISO Tribune, vendor directory record for Commvault, published November 8, 2026