Description
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. Successful exploitation results in a valid user session for a low privilege role.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Commvault | CommCell | 11.32.0 – ≤ 11.32.101, 11.36.0 – ≤ 11.36.59 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Commvault Command-Line Argument Injection to Traversal Remote Code Execution
exploit/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- WID-SEC-2025-1867 Commvault Backup & Recovery: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 20, 2025
- NCSC-2025-0265 Kwetsbaarheden verholpen in Commvault NCSC-NL (Netherlands) · Aug 20, 2025