A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.

Researchers have published a proof-of-concept details for four flaws in Commvault. Patch as soon as possible. We are monitoring for exploitation.

Commvault CommandCenter versions prior to 11.36.60 contain a vulnerability in a known login mechanism that allows unauthenticated attackers to execute API calls without requiring user credentials.

The version of Commvault installed on the remote host is 11.32.x prior to 11.32.102 or 11.36.x prior to 11.36.60. It is, therefore, affected by multiple vulnerabilities as disclosed in Commvault advisories CV_2025_08_1, CV_2025_08_2, CV_2025_08_3 and CV_2025_08_4:

  - A security vulnerability has been identified that allows remote attackers to inject or manipulate   command-line arguments passed to internal components due to insufficient input validation. Successful   exploitation results in a valid user session for a low privilege role. (CVE-2025-57791)

  - A security vulnerability has been identified that allows remote attackers to perform unauthorized file   system access through a path traversal issue. The vulnerability may lead to remote code execution.
  (CVE-2025-57790)

  - During the brief window between installation and the first administrator login, remote attackers may   exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs   have been configured. (CVE-2025-57789)

  - A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without   requiring user credentials. RBAC helps limit the exposure but does not eliminate risk. (CVE-2025-57788)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
115096	Commvault CommandCenter < 11.36.60 Unauthorized API Access	Web App Scanning	Component Vulnerability	Check Based	medium
253649	Commvault 11.32.x < 11.32.102 / 11.36.x < 11.36.60 Multiple Vulnerabilities (CV_2025_08_1-4)	Nessus	Windows	Local	high

Detections

Analytics

CVE-2025-57788

medium

Tenable Plugins

medium

high