Pre-Auth Exploit Chains Found in Commvault Could Enable Remote Code Execution Attacks

Summary: Commvault released updates for four vulnerabilities in versions before 11.36.60, credited to watchTowr Labs researchers Sonny Macdonald and Piotr Bazydlo, who reported them in April 2025. watchTowr said the flaws can be combined into two pre-authenticated exploit chains for code execution, one pairing CVE-2025-57791 and CVE-2025-57790 and the other stringing CVE-2025-57788, CVE-2025-57789, and CVE-2025-57790.
Bottom line: The second pre-auth remote code execution chain works only if the built-in admin password was never changed since installation, and this disclosure follows a prior Commvault Command Center flaw, CVE-2025-34028 with a CVSS score of 10.0, that CISA added to its Known Exploited Vulnerabilities catalog after evidence of active exploitation in the wild.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-34028 CVE-2025-57788 CVE-2025-57789 CVE-2025-57790 CVE-2025-57791
Related: ⚡ Weekly Recap: Password Manager Flaws, Apple 0-Day, Hidden AI Prompts, In-the-Wild Exploits & More Cyber Risks ·
CVE-2025-34028: Commvault Command Center Path Traversal Vulnerability Known Exploited Vulnerabilities · May 02, 2025
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026