Commvault Command Center Path Traversal Vulnerability (CVE-2025-34028)

What is affected, what to do

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20.

The vulnerability is being actively exploited; treat it as a priority. Update commvault to version 11.38.20. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Commvault Command Center Innovation Release lte 11.38.0..11.38.25

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Patch Commvault Command Center Innovation Release immediately: upgrade to 11.38.20 with hotfix SP38-CU20-433 or SP38-CU20-436, or to 11.38.25 with SP38-CU25-434 or SP38-CU25-438. Any build from 11.38.0 up to unpatched 11.38.20 is vulnerable.
   • Until patched, remove the Command Center web UI (typically TCP/443, internally sometimes TCP/80 or ports in the 8400 range) from the public internet — restrict to VPN or jump-host access. The flaw is network-reachable and requires no authentication.
   • Emergency scoping: inventory every CommServe and WebServer role (install path Program Files\Commvault, processes cvd.exe, tomcat*), confirm build version via qlist media or the Admin Console, and compare against the fix matrix.
   • Inspect Tomcat webapp directories and upload/temp paths (e.g. \WebConsole\, \CVAppliance\, staging folders under \iDataAgent\) for unknown .jsp files, recently expanded ZIP archives and unusual timestamps since early 2025 — preserve forensically before patching overwrites artefacts.
   • Rotate Command Center service accounts (local service users and AD accounts running Commvault services) plus API/Qlogin credentials if compromise is suspected. Validate backup catalogue integrity, since RCE on the backup fabric has immediate supply-chain impact.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: place Command Center in a dedicated management VLAN with an explicit allowlist (admin jump hosts, monitoring). Block outbound internet traffic from the Commvault host at the firewall to defeat reverse shells and tool staging.
   • Front the Command Center with a WAF/reverse proxy; only permit multipart/form-data uploads to /commandcenter/, /webconsole/ upload endpoints from authenticated sessions. Drop requests containing path traversal sequences (..\, ..%2f, %2e%2e) or ZIP content types on these endpoints.
   • IPS rule: alert on inbound HTTP(S) requests carrying ZIP magic (PK\x03\x04) in the body to Commvault URIs. Starting-point Suricata/Snort signature: http.request_body; content:"PK|03 04|"; http.uri; content:"commandcenter";.
   • Endpoint hardening: do not run the Command Center Tomcat process as SYSTEM/root where vendor-supported; add an AppLocker/WDAC rule denying JSP execution outside the pristine webapp paths; minimise write permissions on the webroot to the installer service account only.
   • IAM: enforce MFA on all Commvault admin accounts, integrate SAML/SSO, disable local fallback accounts. Short-lived API tokens; separate roles for backup operations versus infrastructure administration.
   • Tomcat configuration monitoring: enable file integrity monitoring on the webapp directory with alerts on any new or modified .jsp, .war, .class file.
3. 03

   Runbook step 3

   Detection rules

   • Tomcat localhost_access_log: POST requests with Content-Type application/zip or multipart/form-data to Command Center upload endpoints, followed within seconds by GET requests to previously unseen .jsp paths — the canonical dropper pattern.
   • Sysmon EID 1 (Process Create) on Commvault hosts: children of tomcat*.exe or java.exe spawning cmd.exe, powershell.exe, whoami, net user, cscript. KQL sketch: DeviceProcessEvents | where InitiatingProcessFileName in~ ("java.exe","tomcat9.exe") and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe").
   • Sysmon EID 11 / Linux auditd path: file writes with .jsp extension outside the legitimate webapp directory, especially paths containing .. prior to normalisation or located in temp/staging folders.
   • Network telemetry (Zeek http.log, files.log): uploads with MIME application/zip to Commvault URIs sourced from non-administrative subnets; filter Zeek files.log on PK magic plus the Command Center host as destination.
   • Sigma shape: detection: selection: ParentImage|endswith: '\tomcat*.exe' Image|endswith: ('\cmd.exe','\powershell.exe','\sh','\bash') condition: selection — a backup server should never spawn interactive shells.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.

Source: pwn.watch, CSA/SingCERT, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Commvault Commvault Cloud

Weakness classes (CWE)

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  Base

  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

  Entry at MITRE CWE-22

• CWE-306Missing Authentication for Critical Function

  Base

  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

  Entry at MITRE CWE-306

References & sources

• documentation.commvault.comCommvault advisory: Commvault Command CenterVendor advisory, Vendor advisory, pwn-watch
• labs.watchtowr.comfire-in-the-hole-were-breaching-the-vault-commvault-remote-code…Exploit, Third-party advisory
• github.comwatchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028Exploit, Exploit
• vulncheck.comadvisories/commvault-command-center-innovation-release-unauthen…Third-party advisory, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34028government-resource, US government resource
• pwn.watchpwn.watch: Commvault Command Center: Command Center Path Traversal Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2025-34028pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch