The U.S. Cybersecurity and Infrastructure Safety Company (CISA) has added a maximum-severity safety flaw impacting Commvault Command Middle to its Identified Exploited Vulnerabilities (KEV) catalog, a little bit over every week after it was publicly disclosed.
The vulnerability in query is CVE-2025-34028 (CVSS rating: 10.0), a path traversal bug that impacts 11.38 Innovation Launch, from variations 11.38.0 by 11.38.19. It has been addressed in variations 11.38.20 and 11.38.25.
“Commvault Command Middle incorporates a path traversal vulnerability that enables a distant, unauthenticated attacker to execute arbitrary code,” CISA mentioned.
The flaw primarily permits an attacker to add ZIP information that, when decompressed on the goal server, may end in distant code execution.
Cybersecurity firm watchTowr Labs, which was credited with discovering and reporting the bug, mentioned the issue resides in an endpoint known as “deployWebpackage.do” that triggers a pre-authenticated Server-Facet Request Forgery (SSRF), finally leading to code execution when utilizing a ZIP archive file containing a malicious .JSP file.
It is at present not identified in what context the vulnerability is being exploited, however the improvement makes it the second Commvault flaw to be weaponized in real-world assaults after CVE-2025-3928 (CVSS rating: 8.7), an unspecified subject within the Commvault Internet Server that enables a distant, authenticated attacker to create and execute internet shells.
The corporate revealed final week that the exploitation exercise affected a small variety of clients however famous that there was no unauthorized entry to buyer backup information.
In mild of lively exploitation of CVE-2025-34028, Federal Civilian Govt Department (FCEB) businesses are required to use the required patches by Could 23, 2025, to safe their networks.
