CVE-2025-34028

The vulnerability in the Commvault Command Center Innovation Release arises from an unauthenticated file upload feature that permits malicious actors to upload ZIP files containing crafted install packages. When these ZIP files are extracted on the target server, they exploit a path traversal vulnerability, allowing attackers to manipulate file paths and potentially execute arbitrary code. This flaw is particularly dangerous because it enables an attacker to upload malicious JavaServer Pages (JSP) files, which can be executed on the server, leading to remote code execution (RCE). The severity of this vulnerability is underscored by its maximum CVSS score of 10.0, indicating a critical risk that requires immediate attention.

The attack vectors for this vulnerability are straightforward yet effective. An attacker can leverage the unauthenticated upload capability to introduce a specially crafted ZIP file into the system. Once uploaded, the server’s extraction process does not adequately validate the file paths, allowing the attacker to place malicious JSP files in locations accessible to the web server. This exploitation can occur without any user authentication, making it particularly appealing to threat actors. Scenarios could include an attacker targeting a vulnerable system within a corporate network, leading to unauthorized access to sensitive data, lateral movement within the network, or even complete system compromise.

The real-world impact of this vulnerability can be devastating for organizations using the affected versions of the Commvault Command Center. Successful exploitation could lead to unauthorized access to critical data, disruption of services, and significant financial losses due to operational downtime and recovery efforts. Furthermore, the potential for data breaches could result in regulatory penalties and reputational damage, particularly for organizations handling sensitive information. The risk escalates when considering the possibility of attackers using compromised systems to launch further attacks against other connected systems, thereby expanding the attack surface.

To detect and mitigate this vulnerability, organizations should implement several strategies. First, it is crucial to apply the available patches, specifically the updates provided in versions 11.38.20 and 11.38.25, which address this vulnerability directly. Regularly updating software and systems is a fundamental practice in cybersecurity hygiene. Additionally, organizations should employ web application firewalls (WAFs) to monitor and filter incoming traffic, particularly focusing on file upload functionalities. Intrusion detection systems (IDS) can also be configured to identify suspicious file uploads and alert administrators to potential exploitation attempts.

In conclusion, the vulnerability within the Commvault Command Center represents a significant threat to organizations that utilize this software. The combination of unauthenticated access, file upload capabilities, and path traversal exploitation creates a pathway for remote code execution, with far-reaching implications for data security and operational integrity. Organizations must prioritize patch management, implement robust detection mechanisms, and educate their teams on the risks associated with such vulnerabilities to safeguard against potential exploitation.

CSURFACE threat intelligence has observed a moderate increase in the Exploit Prediction Scoring System (EPSS) score for CVE-2025-34028, rising by approximately 10.8%. This uptick reflects heightened potential for exploitation despite a concurrent notable reduction in detection activity across our telemetry, suggesting adversaries may be refining their tactics to evade current detection mechanisms. Additionally, new proof-of-concept exploits have emerged on public repositories, expanding the toolkit available to threat actors and lowering the barrier for exploitation attempts. Although ransomware usage linked to this vulnerability remains unconfirmed, the elevated EPSS score and the availability of multiple scanning and exploitation scripts indicate an increased likelihood of opportunistic attacks. Consequently, the threat level for CVE-2025-34028 should be considered elevated, with adversaries potentially preparing for broader operational use. Defenders must remain vigilant as the evolving exploit landscape could translate into more frequent and sophisticated intrusion attempts targeting vulnerable Commvault Command Center deployments.

Update 2 — June 20, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2025-34028, reflected by a significant rise in telemetry signals and a substantial increase in the Exploit Prediction Scoring System (EPSS) score. This upward trend coincides with the emergence of additional publicly available proof-of-concept exploits, including advanced scanning and remote code execution tools, which lower the barrier for adversaries to identify and compromise vulnerable Commvault Command Center instances. The convergence of increased detection activity and expanding exploit resources amplifies the risk of opportunistic attacks, potentially accelerating the timeline for widespread exploitation. Although ransomware involvement remains unconfirmed, the evolving exploit landscape and heightened attacker interest necessitate an elevated threat posture. Defenders should interpret these developments as indicative of a growing likelihood of targeted intrusion attempts leveraging this critical vulnerability.