Vendor

Commvault

2 of 7 Commvault CVEs in Patchfirst (29%) are in of vulnerabilities exploited in the wild.

CVEs: 7
In CISA KEV: 229%
Known ransomware use: 0
Median days to KEV: 6; from publication
Latest KEV listing: 2 May 2025

Watch Commvault Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
Command Center In KEV: 1 CVEs: 1
Web Server In KEV: 1 CVEs: 1
CommCell In KEV: 0 CVEs: 4
Commvault Cloud In KEV: 0 CVEs: 1

Top ATT&CK techniques

What attackers do with Commvault CVEs

TechniqueCVEs
T1190Exploit Public-Facing Application CVEs: 1
T1059.007JavaScript CVEs: 1
T1059Command and Scripting Interpreter CVEs: 1
T1505.003Web Shell CVEs: 1

Open in ATT&CK Navigator

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/commvault.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are Commvault CVEs linked to the technique. Each link’s provenance is on the CVE page.

Commvault CVEs

7 CVEs, by priority

CVE-2025-34028Commvault Command Center Path Traversal Vulnerability
Commvault · Command CenterKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing Application T1059.007JavaScript
97.6%Top 0.1%
70.0priority
CVE-2025-57788Unauthorized API Access Risk
Commvault · CommCellPublic exploitMedium · 6.9
7.8%Top 5.4%
63.8priority
CVE-2025-3928Commvault Web Server Unspecified Vulnerability
Commvault · Web ServerKEVHigh · 8.8T1059Command and Scripting Interpreter T1505.003Web Shell
2.5%Top 15%
61.1priority
CVE-2021-34993This vulnerability allows remote attackers to bypass authentication on affected installations of Commvault CommCell…
Commvault · CommCellCritical · 9.8
5.4%Top 7.3%
60.4priority
CVE-2021-34996This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell…
Commvault · CommCellHigh · 8.8
82.3%Top 0.34%
26.1priority
CVE-2021-34995This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell…
Commvault · CommCellHigh · 8.8
68.9%Top 0.65%
26.0priority
CVE-2026-77099CVFS contained an input validation issue affecting command execution
Commvault · Commvault CloudCritical · 9.3
0.4%Top 67%
15.3priority