The U.S. Cybersecurity and Infrastructure Safety Company (CISA) has added a maximum-severity security flaw impacting Commvault Command Middle to its Recognized Exploited Vulnerabilities (KEV) catalog, just a little over per week after it was publicly disclosed.
The vulnerability in query is CVE-2025-34028 (CVSS rating: 10.0), a path traversal bug that impacts 11.38 Innovation Launch, from variations 11.38.0 by means of 11.38.19. It has been addressed in variations 11.38.20 and 11.38.25.
“Commvault Command Middle comprises a path traversal vulnerability that permits a distant, unauthenticated attacker to execute arbitrary code,” CISA mentioned.
The flaw basically permits an attacker to add ZIP recordsdata that, when decompressed on the goal server, may end in distant code execution.
Cybersecurity firm watchTowr Labs, which was credited with discovering and reporting the bug, mentioned the issue resides in an endpoint known as “deployWebpackage.do” that triggers a pre-authenticated Server-Aspect Request Forgery (SSRF), in the end leading to code execution when utilizing a ZIP archive file containing a malicious .JSP file.
It is presently not identified in what context the vulnerability is being exploited, however the improvement makes it the second Commvault flaw to be weaponized in real-world assaults after CVE-2025-3928 (CVSS rating: 8.7), an unspecified subject within the Commvault Net Server that permits a distant, authenticated attacker to create and execute internet shells.
The corporate revealed final week that the exploitation exercise affected a small variety of clients however famous that there was no unauthorized entry to buyer backup information.
In gentle of energetic exploitation of CVE-2025-34028, Federal Civilian Government Department (FCEB) businesses are required to use the required patches by Might 23, 2025, to safe their networks.
