A severe security vulnerability has been identified in Commvault Command Center that could allow attackers to execute arbitrary code without authentication. The flaw, designated as CVE-2025-34028, has received a high-severity CVSS score of 9.0 out of 10.0.

According to Commvault’s April 17, 2025 advisory, “This vulnerability could lead to a complete compromise of the Command Center environment.” The issue affects Commvault’s 11.38 Innovation Release, specifically versions 11.38.0 through 11.38.19, and has been patched in versions 11.38.20 and 11.38.25.

watchTowr Labs researcher Sonny Macdonald, who discovered the vulnerability on April 7, 2025, revealed that the flaw enables pre-authenticated remote code execution. The vulnerability exists in the “deployWebpackage.do” endpoint, which creates a Server-Side Request Forgery (SSRF) vulnerability due to lack of host filtering.

The attack works through a five-step process:
1. Sending an HTTP request to /commandcenter/deployWebpackage.do, causing the Commvault instance to retrieve a malicious ZIP file
2. Unzipping the file contents into a .tmp directory under attacker control
3. Using the servicePack parameter to navigate to a pre-authenticated directory
4. Executing the SSRF via the vulnerable endpoint
5. Running the malicious JSP shell file from the compromised location

watchTowr has released a Detection Artefact Generator to help organizations determine if their systems are vulnerable.

With backup software increasingly targeted by attackers, as seen with recent Veeam and NAKIVO exploits, organizations are strongly advised to implement the necessary patches immediately.