DaystoPatch

VendorsIT management, Infrastructure

Commvault

Commvault makes data protection and backup software, including the Commvault Command Center and the Commvault Cloud (Metallic) SaaS service.

Response trend, 6 months
Not enough history
Open now
None
Latest incident
17 Apr 2025
Incidents on record
2

Response to exploited bugs

Not rated. 2 reviewed zero-days on record. A grade needs at least 3.

Fixing privately reported bugs

Not rated. No private reports in the grading window.

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work

Embed this report card

Why these grades

Every clock starts at the first public report.

  • Response to exploited bugs: not rated. 2 reviewed zero-days in the last 36 months. A grade needs at least 3.
  • First fix within a day for 0 of 2 zero-days. The other 2 took a median of 15 days, longest 19 days.
  • Every supported version fixed within a day for 0 of 2 zero-days. The other 2 took a median of 16 days, longest 19 days.
  • First advisory within a day for all 2 zero-days.
  • Fixing privately reported bugs: not rated. No private reports in the last 36 months.
  • NR (not rated) means a subject has fewer than 3 data points from the last 36 months, or their recency weights add up to less than one current data point. For response, a data point is a reviewed exploited zero-day. For private fixes, it is a private report (one vendor, one report date). KEV listings alone never rate a vendor. A grade is provisional when the vendor's own evidence does not yet outweigh the starting value, or confidence is below medium.

Response to exploited bugs: sub-scores

  • Time to first advisory2 of 2 zero-days within a day
    79
    2 cases, low confidence, not used for this vendor
  • Time to first fix0 of 2 zero-days within a day, longest 19 days
    70
    2 cases, low confidence, not used for this vendor
  • Time to fix all versions0 of 2 zero-days within a day, longest 19 days
    76
    2 cases, low confidence, not used for this vendor
  • OpennessNo machine-readable advisory feed listed. 2 of 2 zero-days with a dated revision history. 1 of 1 advisories said the bug was exploited. 2 of 2 fixed zero-days with a public fix date for every version. 2 of 2 zero-days not fixed within a day had an advisory or mitigation within 72 hours.
    55
    5 cases, medium confidence, not used for this vendor

Fixing privately reported bugs: sub-score

  • Private fix speedNo private reports in the last 36 months
    NR
    0 cases, not used

Response fingerprint

Median of 2 graded zero-days. Vendor statement 0h, first fix 15d, all versions 17d.

Compressed time scale

Counts toward the response grade 2

  1. 17 Apr 2025Commvault Command Center Innovation Release pre-authentication path traversal RCE (CV_2025_04_1)
  2. 24 Feb 2025Commvault Web Server webshell vulnerability (CV_2025_03_1)
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Open, no fix
  • Open, partly fixed
  • Fixed when disclosed
  • Date only, no time of day

One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.

Exploited incidents

2 in 24 months, 0 with known ransomware use, 100% exploited before a fix

First reportIncidentCVSSSilenceFirst fixAll fixedStatusGrade
17 Apr 2025Commvault Command Center Innovation Release pre-authentication path traversal RCE (CV_2025_04_1)CVE-2025-3402810.0same day19d19dFixedCounts toward grade
24 Feb 2025Commvault Web Server webshell vulnerability (CV_2025_03_1)CVE-2025-39288.8same day11d14dFixedCounts toward grade

Private reports

None in the window

Bugs reported privately to Commvault by ZDI or Project Zero.

No privately reported cases from ZDI or Project Zero in the window.

Advisories changed after publication

1 shown, 0 without a revision note

  1. CV_2025_03_1

    Recorded in the revision history

    CV_2025_03_1: Critical Webserver Vulnerability HIGH

    Version table: 1 row added and 1 row removed. One new row reads "Commvault | Linux, Windows | 11.32.0 - 11.32.88 | 11.32.89 | Resolved".

    • Fixed versions
    Version table rows
    BeforeCommvault | Linux, Windows | 11.32.0 - 11.32.87 | 11.32.88 | Resolved
    AfterCommvault | Linux, Windows | 11.32.0 - 11.32.88 | 11.32.89 | Resolved
    Verbatim wording. Removed text is struck through. Added text is bold.
    Before

    ed Products Product | Platforms | Affected Versions | Resolved Version | Status Commvault | Linux, Windows | 11.36.0 - 11.36.45 | 11.36.46 | Resolved Commvault | Linux, Windows | 11.32.0 - 11.32.87 | 11.32.88 | Resolved Commvault | Linux, Windows | 11.28.0 - 11.28.140 | 11.28.141 | Resolved Commvault | Linux, Windows | 11.20.0 - 11.20.216 | 11.20.217 | Resolved Resolution To prevent this issue, im

    After

    ed Products Product | Platforms | Affected Versions | Resolved Version | Status Commvault | Linux, Windows | 11.36.0 - 11.36.45 | 11.36.46 | Resolved Commvault | Linux, Windows | 11.32.0 - 11.32.88 | 11.32.89 | Resolved Commvault | Linux, Windows | 11.28.0 - 11.28.140 | 11.28.141 | Resolved Commvault | Linux, Windows | 11.20.0 - 11.20.216 | 11.20.217 | Resolved Resolution To prevent this issue, im

    Earlier version captured 10 Mar 2025, 05:20 UTC: archived copyLater version captured 27 Mar 2025, 13:45 UTC: archived copyRecovered from archived copiesSnapshots 48906bf11d… and c30e9002f1…Incident page

Grade history

Response to exploited bugs: score at the end of each month.

Not rated at any point in this period.

Channels

Get Commvault's own alerts

What we watch

We don't poll this vendor's channels yet. Incidents come from public sources.

See sources and health for when each was last read.