CommvaultExploited incident
Commvault Command Center Innovation Release pre-authentication path traversal RCE (CV_2025_04_1)
CVE-2025-34028Critical, CVSS 10.0In CISA's Known Exploited Vulnerabilities catalog since 2 May 2025
- Exploited before a fix
Response
- Silence
- same day First public report to first vendor statement
- Exposure
- 19d First public report to first fix
- Follow-through
- 19d First public report to a fix for every supported version
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Fixed when disclosed
- Date only, no time of day
Timeline and evidence
Open a moment to see its source and archived quote.
First public report
date only
watchTowr Labs blog (Published 24 Apr 2025), disclosure timelineCuratedQuote verified
Commvault released a patch for these vulnerabilities on April 10, 2025, and subsequently released an advisory on April 17, 2025
First public signal: the advisory's publication, dated by the reporting researcher. The advisory's own 'Issued: 2025-04-11' field is not supported by any capture (first capture 2025-04-22) and is treated as an internal/backdated date (see notes).
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:2d825b2419a2a5cd…- Used in metrics
- Yes
5 more sources for this moment
CVE.org record CVE-2025-34028ClaimedQuote verified22 Apr 2025, 16:32 UTC
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path
CVE record published.
- Source
- CVE.org record CVE-2025-34028 cve record
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:92347955b7ffb17d…- Used in metrics
- No, kept for the record
Bluesky postClaimedQuote not checked yet22 Apr 2025, 16:58 UTC
You can now share your thoughts on vulnerability CVE-2025-34028 in Vulnerability-Lookup:
Earliest third-party post we hold.
- Source
- Bluesky post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
Mastodon postClaimedQuote not checked yet23 Apr 2025, 14:44 UTC
CVE Alert: CVE-2025-34028 - https://www. redpacketsecurity.com/cve_aler t_cve-2025-34028/ # OSINT # ThreatIntel # CyberSecurity # cve_2025_34028
Earliest third-party post we hold.
- Source
- Mastodon post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
Hacker NewsClaimedQuote not checked yet25 Apr 2025, 09:46 UTC
https://labs.watchtowr.com/fire-in-the-hole-were-breaching-the-vault-commvault-remote-code-execution-cve-2025-34028/
Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.
- Source
- Hacker News hn
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
CISA KEV (CVE-2025-34028)ClaimedQuote verified2 May 2025
Commvault Command Center Path Traversal Vulnerability
Added to CISA's KEV catalog on 2025-05-02.
- Source
- CISA KEV (CVE-2025-34028) kev
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:ef8fffede5c47200…- Used in metrics
- No, kept for the record
Vendor statement
date onlysame day
watchTowr Labs blog (Published 24 Apr 2025), disclosure timelineCuratedQuote verified
Commvault released a patch for these vulnerabilities on April 10, 2025, and subsequently released an advisory on April 17, 2025
Publication date of the advisory per watchTowr's timeline ('17th April 2025 Commvault publishes an advisory'). The advisory itself shows 'Issued: 2025-04-11'; no copy from before 2025-04-22 exists.
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:2d825b2419a2a5cd…- Used in metrics
- Yes
First workaround
date only+5d
Commvault security advisory CV_2025_04_1 (Wayback snapshot 2025-04-22, 'Updated: 2025-04-15')CuratedQuote verified
If installing the update is not feasible, then isolate the Command Center installation from external network access.
Earliest captured copy of the advisory containing this mitigation is the Wayback snapshot of 2025-04-22 (the page shows 'Updated: 2025-04-15', but watchTowr says the advisory was published on 17 April 2025).
- Source
- Commvault security advisory CV_2025_04_1 (Wayback snapshot 2025-04-22, 'Updated: 2025-04-15') vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:3c09f5bdce8a2009…- Used in metrics
- Yes
First fix
date only+19d
Commvault security advisory CV_2025_04_1 (Wayback snapshot 2025-05-15)CuratedQuote verified
UPDATE (May 6th, 2025) - Added details about additional updates.
Upper bound: fixed builds may have shipped earlier. Under R1 the complete fix is 11.38.20 or 11.38.25 plus the additional updates (SP38-CU20-433/436, SP38-CU25-434/438), first listed in this update; the 2025-05-02 snapshot still shows only '11.38.20, which includes the fix as of April 10, 2025'. Arctic Wolf (May 9, 2025): Commvault 'has clarified that being on versions 11.38.20 or 11.38.25 alone is not sufficient'.
- Source
- Commvault security advisory CV_2025_04_1 (Wayback snapshot 2025-05-15) vendor advisory update
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:d66cfd26d67539a2…- Used in metrics
- Yes
Fixed for all versions
date only+19d
Commvault security advisory CV_2025_04_1 (Wayback snapshot 2025-05-15)CuratedQuote verified
UPDATE (May 6th, 2025) - Added details about additional updates.
Only one affected line (11.38 Innovation Release); upper bound as for patch_first.
- Source
- Commvault security advisory CV_2025_04_1 (Wayback snapshot 2025-05-15) vendor advisory update
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:d66cfd26d67539a2…- Used in metrics
- Yes
Send this to your boss
Commvault Command Center pre-auth RCE exploited; full fix needs extra updates
A maximum-severity flaw in the Commvault Command Center Innovation Release lets an unauthenticated attacker run code on the server; it was exploited after a public proof of concept, and the complete fix requires specific additional updates on top of 11.38.20 or 11.38.25.
In plain words
Commvault's backup management console had a flaw that let an outsider take control of the server without a password, and attackers began using it after researchers published details in April 2025. Commvault's first fix turned out to need extra update packages, which it listed on 6 May 2025. If we run the affected Commvault release, we need to confirm those specific updates are installed on every console server and keep the console off the internet.
What happened and who is affected
What happened
CVE-2025-34028 is a path traversal flaw in the Commvault Command Center Innovation Release (11.38) that lets an unauthenticated attacker upload a crafted ZIP package and run code. Commvault's advisory was published on 17 April 2025 according to watchTowr (the page itself says 11 April) and said 11.38.20 included the fix as of 10 April. watchTowr published technical details and a proof of concept on 24 April, and CISA listed the flaw as exploited on 2 May. On 6 May Commvault updated the advisory to say specific additional updates must also be installed.
Who is affected
Commvault Command Center installations on the 11.38 Innovation Release (11.38.0 to 11.38.25) without the additional updates SP38-CU20-433 and SP38-CU20-436 (on 11.38.20) or SP38-CU25-434 and SP38-CU25-438 (on 11.38.25). Other Commvault releases are not affected; Commvault SaaS was patched by Commvault.
Affected products
- Commvault Command Center Innovation Release 11.38.0 - 11.38.19 (Linux, Windows)
How we built this timeline
CORRECTION PASS 23 Oct 2026 (R1, R4): Commvault first said 11.38.20 'includes the fix as of April 10, 2025' (watchTowr: '10th April 2025 Commvault release a fix'), but later described the resolution as 11.38.20/11.38.25 'with the following additional updates', added 6 May 2025 (Arctic Wolf: 'being on versions 11.38.20 or 11.38.25 alone is not sufficient'). The NVD/CVE description now lists 11.38.20 itself as affected.
So First fix = Fixed for all versions = 6 May 2025 (upper bound), and the April 10 build is noted here only. exploited before a fix=true: exploitation was publicly reported (CISA KEV 2 May 2025) after watchTowr's 24 Apr 2025 PoC and before the complete fix. AUDIT 2 (T5): world and vendor now use 17 Apr 2025, the publication date given by watchTowr ('Commvault publishes an advisory' on 17th April 2025; first Wayback capture 22 Apr 2025, CVE assigned 22 Apr 2025).
The advisory's 'Issued: 11 Apr 2025' field is no longer recorded as a moment because nothing shows the advisory public before 04-17 (possibly backdated). Exposure is about 19 days (04-17 to 05-06) instead of 25.
Reported by watchTowr on 7 Apr 2025; CVE assigned via VulnCheck on 22 Apr 2025.
CVSS: the advisory first showed 'CVSS Score: 9.0' and later 'CVSS Score: 10'; we use 10.0 (VulnCheck CNA CVSS 4.0: 9.3). Commvault advisory pages are cited via Wayback because documentation.commvault.com disallows automated fetching.
Related
No related incidents.