A critical pre-authenticated Remote Code Execution (RCE) vulnerability has been identified in Commvault’s backup and data protection platform.
Tracked as CVE-2025-34028, this flaw could enable attackers to compromise enterprise backup systems without needing authentication, placing organizations’ most sensitive data at significant risk.
The vulnerability was discovered in Commvault’s “Innovation Release” versions 11.38.0 through 11.38.19 and has been addressed with a patch in version 11.38.20.
Researchers from watchTowr Labs uncovered the flaw earlier this month and have since released a public proof-of-concept (PoC) exploit.
The vulnerability affects two pre-authenticated endpoints — deployWebpackage.do and deployServiceCommcell.do — within Commvault’s web administration interface. These endpoints are explicitly exempted from authentication checks according to the platform’s authSkipRules.xml configuration file.
“Backup and replication solutions have become prime targets for ransomware operators for logical reasons,” the researchers noted.
“Ransomware loses its impact if backups can easily restore affected systems — but if the backups themselves are compromised, administrators are left with few options.”
| Factor | Details |
|---|---|
| Affected Products | Commvault Command Center Innovation Release, versions 11.38.0 to 11.38.19 |
| Impact | Pre-authenticated Remote Code Execution (RCE) |
| Exploit Requirements | No authentication required; attacker must have network access to the vulnerable endpoints. No user interaction is necessary. |
| CVSS 3.1 Score | 10.0 (Critical) |
Commvault RCE Vulnerability – Proof-of-Concept (PoC) Overview
The exploitation process starts with the attacker sending a crafted HTTP request to a vulnerable endpoint:
Commvault RCE Vulnerability – Exploit Details
The attack begins with a specially crafted HTTP request that triggers a Server-Side Request Forgery (SSRF) vulnerability, causing the application to retrieve content from an attacker-controlled server. Exploiting this flaw allows attackers to:
- Coerce the Commvault server into downloading a ZIP file from an external server.
- Leverage path traversal through the
servicePackparameter to place files in otherwise restricted directories. - Extract malicious JSP files into executable locations on the server.
- Access and execute the uploaded malicious code via the web interface.
Commvault, which positions itself as a “Data Protection and Cyber Resilience” provider, is widely deployed across large enterprises, managed service providers (MSPs), and government agencies.
The researchers who uncovered the vulnerability stressed that backup and replication solutions hold value far beyond the data they protect. These systems often store highly privileged credentials, owing to their automation and deep integration within environments.
Given the central role of backup platforms in organizational cybersecurity — particularly in defending against ransomware — this vulnerability is especially critical.
With proof-of-concept (PoC) exploit code now publicly available, security teams are urged to review their Commvault environments for signs of compromise. Organizations running affected versions should immediately upgrade to version 11.38.20 or later to mitigate the risk.
