{"metadata": {"vulnerability": "CVE-2026-13737", "count": 16, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-06-29T14:54:15.451Z", "date_only": false, "value": "2026-06-29T14:54:15.451Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-13737", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-11T11:01:38.785Z", "date_only": false, "value": "2026-08-11T11:01:38.785Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-13737", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-11T11:01:38.785Z", "date_only": false, "value": "2026-08-11T11:01:38.785Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Commvault", "record": "CVE-2026-13737", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-11T11:48:27.121Z", "date_only": false, "value": "2026-08-11T11:48:27.121541Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3msskabas5b2n", "record": "CVE-2026-13737", "field": "creation_timestamp", "uuid": "46356bbf-5b51-4895-8c5e-ab933033c0c4", "content": "\u26a0\ufe0f PATCH NOW\n\nCommvault patched a critical flaw (CVSS 9.2) in CommServe, the brain of its backup platform: an allowlist bypass lets blocked commands run.\n\nAffects versions 11.36 to 11.46 on Linux and Windows.\n\nFix: update to the patched release now. (CVE-2026-13737)", "url": "https://bsky.app/profile/suriq.io/post/3msskabas5b2n"}, {"timestamp": "2026-08-11T12:17:37Z", "date_only": false, "value": "2026-08-11T12:17:37Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VPJP-54P7-3QC9", "record": "GHSA-VPJP-54P7-3QC9", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-08-11T12:17:37.180Z", "date_only": false, "value": "2026-08-11T12:17:37.180", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-13737", "record": "FKIE_CVE-2026-13737", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-11T12:30:22Z", "date_only": false, "value": "2026-08-11T12:30:22Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VPJP-54P7-3QC9", "record": "GHSA-VPJP-54P7-3QC9", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-11T13:20:05.560Z", "date_only": false, "value": "2026-08-11T13:20:05.560718Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msspe5e6nu2g", "record": "CVE-2026-13737", "field": "creation_timestamp", "uuid": "ac2c20e9-87bf-4618-a162-b6f445a09741", "content": "CVE-2026-13737 - commvault cloud\nA security issue in Commvault software allows unauthorized access to certain commands. This could allow an attacker to perform actions they shouldn't be able to do.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#commvaultcloud #commvault #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3msspe5e6nu2g"}, {"timestamp": "2026-08-11T16:48:52.032Z", "date_only": false, "value": "2026-08-11T16:48:52.032563Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-13737", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-11T16:48:52.032Z", "date_only": false, "value": "2026-08-11T16:48:52.032563Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-13737", "record": "FKIE_CVE-2026-13737", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-11T16:49:09.354Z", "date_only": false, "value": "2026-08-11T16:49:09.354Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-13737", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-11T16:49:09.354Z", "date_only": false, "value": "2026-08-11T16:49:09.354Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-13737", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-12T11:39:39.150Z", "date_only": false, "value": "2026-08-12T11:39:39.150636Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecinsight.bsky.social/post/3msv27hkru62l", "record": "CVE-2026-13737", "field": "creation_timestamp", "uuid": "eab9ce1d-1ac9-4aa0-ba36-4f7fefce990c", "content": "\ud83d\udd0d Vulnerability Spotlight | Part 2/3\n\n\u26a0\ufe0f CVE-2026-13737\n\nCommServe contained an allowlist bypass vulnerability affecting command execution authorization.  Software customers upgrade to resolved maintenanc...", "url": "https://bsky.app/profile/cybersecinsight.bsky.social/post/3msv27hkru62l"}, {"timestamp": "2026-08-19T12:56:46.195Z", "date_only": false, "value": "2026-08-19T12:56:46.195902Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mtgrrry3q72d", "record": "CVE-2026-13737", "field": "creation_timestamp", "uuid": "55dcc7c3-9212-409c-8d35-09b5660d611b", "content": "Protect your network from CVE-2026-13737 and CVE-2026-13738. These critical Commvault command execution flaws allow hackers to bypass authorization checks.\n\n#Commvault #CVE202613737 #CVE202613738 #Cybersecurity #Vulnerability", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mtgrrry3q72d"}, {"timestamp": "2026-09-09T18:31:04Z", "date_only": false, "value": "2026-09-09T18:31:04Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VPJP-54P7-3QC9", "record": "GHSA-VPJP-54P7-3QC9", "field": "modified"}, {"timestamp": "2026-10-23T19:10:00.167Z", "date_only": false, "value": "2026-10-23T19:10:00.167", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-13737", "record": "FKIE_CVE-2026-13737", "field": "lastModified"}], "metrics": {"as_of": "2026-10-29T07:28:42.868Z", "anchors": {"origin": {"timestamp": "2026-08-11T11:01:38.785Z", "date_only": false, "value": "2026-08-11T11:01:38.785Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-13737", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-08-11T11:01:38.785Z", "date_only": false, "value": "2026-08-11T11:01:38.785Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-13737", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 6812824.083305, "hours": 1892.451134251389, "days": 78.85213059380787, "min_seconds": 6812824.083305, "max_seconds": 6812824.083305, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-11T11:01:38.785Z", "date_only": false, "value": "2026-08-11T11:01:38.785Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-13737", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T07:28:42.868Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}