Commvault vulnerabilities

CVE-2025-34028 [CRITICAL] CWE-22 CVE-2025-34028: The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue affects Command Center Innovation Release: 11.38.0 to 11.

CVE-2025-3928 [HIGH] CVE-2025-3928: Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticat Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to t

CVE-2025-57788 [MEDIUM] CWE-259 CVE-2025-57788: A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls wit A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.

CVE-2017-18044 [CRITICAL] CWE-78 CVE-2017-18044: A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvault service does not properly validate the input of an incoming string before passing it to CreateProcess. As a result, a specially crafted message can inject commands that will be executed on

CVE-2025-57790 [HIGH] CWE-36 CVE-2025-57790: A security vulnerability has been identified that allows remote attackers to perform unauthorized fi A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. The vulnerability may lead to remote code execution.

CVE-2025-57791 [MEDIUM] CWE-88 CVE-2025-57791: A security vulnerability has been identified that allows remote attackers to inject or manipulate co A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. Successful exploitation results in a valid user session for a low privilege role.

CVE-2026-77089 [CRITICAL] CWE-290 CVE-2026-77089: Command Center API contained an authentication bypass issue affecting privilege management. Software Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command Center.

CVE-2026-13737 [CRITICAL] CWE-863 CVE-2026-13737: CommServe contained an allowlist bypass vulnerability affecting command execution authorization. So CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

CVE-2026-77098 [CRITICAL] CWE-89 CVE-2026-77098: Private Metrics Server contained an SQL injection condition affecting database operations. Software Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

CVE-2026-13739 [CRITICAL] CWE-918 CVE-2026-13739: A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.

CVE-2026-13738 [CRITICAL] CWE-863 CVE-2026-13738: CommServe contained an authorization bypass vulnerability affecting a limited set of command executi CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

CVE-2025-57789 [MEDIUM] CWE-257 CVE-2025-57789: During the brief window between installation and the first administrator login, remote attackers may During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.

CVE-2026-77092 [CRITICAL] CWE-502 CVE-2026-77092: Content Extractor contained a deserialization of untrusted data issue affecting privilege management Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Content Extractor.

CVE-2026-77106 [HIGH] CWE-862 CVE-2026-77106: Cvlaunchd contained a missing authorization issue affecting command execution authorization. Softwar Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.

CVE-2026-77105 [HIGH] CWE-347 CVE-2026-77105: CommServe contained a cryptographic signature verification issue affecting privilege management. Sof CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and Web Server.

CVE-2026-77103 [HIGH] CWE-288 CVE-2026-77103: CommServe contained an authentication bypass issue affecting access authorization and information di CommServe contained an authentication bypass issue affecting access authorization and information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.

CVE-2026-77097 [HIGH] CWE-306 CVE-2026-77097: Private Metrics Server contained a missing authentication condition affecting metrics upload functio Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Software customers upgrade to resolved maintenance release. Update Private Metrics Server.

CVE-2026-77102 [HIGH] CWE-122 CVE-2026-77102: CommServe contained a heap-based buffer overflow issue affecting service availability. Software cust CommServe contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release. Update CommServe.

CVE-2025-34136 [MEDIUM] CWE-89 CVE-2025-34136: An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38 An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed. Other Commvault components deployed in the same enviro

CVE-2026-77104 [HIGH] CWE-22 CVE-2026-77104: CommServe contained a path traversal issue affecting information disclosure. Software customers upgr CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe.