VulnSocial

CVE-2025-34028Active Exploitation(commvault / commvault)

MEDIUMCVSS 10.0 · CRITICALCISA KEV

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch commvault commvault systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP. This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.

commvault CVEsBack to dashboard
4.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-05-23. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-22CWE-306

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • commvault
  • linux_kernel
  • windows

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 1 signal
  • Peaked 1d ago at 1 mentions (2026-04-08); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
commvaultlinuxmicrosoft
Products
commvaultlinux_kernelwindows

1 version affected across 3 products

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-04-08: 1Mentions · 2026-07-02: 1Active Exploitation · 2026-04-08: 1Patch / Workaround · 2026-07-02: 104-0807-02
Signal classification2 categories
Active Exploitation
150.0%
Patch
150.0%
Referenced assets1 URL
Classification over time
DateTotalLabels
2026-04-081
Active Exploitation1
2026-07-021
Patch1
Full discourse2 posts
  • Team Cymru Research@teamcymru_S2
    Active Exploitation

    🚨 Top 25 CVE Exploitation Attempts - Team Cymru - S2 (Ranked by unique source IPs over 14 days) 1. CVE-2025-0282 · Ivanti Connect Secure 2. CVE-2025-49706 · SharePoint 3. CVE-2020-3452 · Cisco ASA 4. CVE-2025-61884 · Oracle EBS 5. CVE-2024-32113 · Apache OFBiz 6. CVE-2025-53770 · SharePoint 7. CVE-2025-24893 · XWiki 8. CVE-2025-61882 · Oracle EBS 9. CVE-2025-5777 · Citrix NetScaler 10. CVE-2025-34028 · Commvault 11. CVE-2024-57727 · SimpleHelp 12. CVE-2025-20362 · Cisco ASA/FTD 13. CVE-2024-1212 · Kemp LoadMaster 14. CVE-2024-38856 · Apache OFBiz 15. CVE-2022-40684 · Fortinet 16. CVE-2024-9465 · Palo Alto Expedition 17. CVE-2025-11371 · Gladinet CentreStack 18. CVE-2025-58360 · GeoServer 19. CVE-2025-57819 · FreePBX 20. CVE-2025-31324 · SAP NetWeaver 21. CVE-2024-7593 · Ivanti vTM 22. CVE-2025-31125 · Vite Dev Server 23. CVE-2025-64446 · FortiWeb 24. CVE-2024-12987 · DrayTek Vigor 25. CVE-2018-7600 · Drupal

    Post summary

    Team Cymru reports the top 25 CVEs that have been targeted in exploitation attempts over a 14‑day period.

    070921.2K
    5.5K followersView on X
  • PatchDayAlert@patchdayalert
    Patch

    Commvault CVE-2025-34028 is patched in 11.38.20, right? Wrong. The fix needs supplemental updates most teams never install. Check your version number and find out what you're actually running. https://patchdayalert.com/blog/commvault-cve-2025-34028-upgrading-is-not-the-whole-fix/?utm_source=x&utm_medium=social&utm_campaign=blog-tease&utm_content=commvault-cve-2025-34028-upgrading-is-not-the-whole-fix

    Post summary

    The post cautions that the Commvault update for CVE‑2025‑34028 in version 11.38.20 is incomplete and requires additional fixes that many teams overlook, urging users to verify their current versions.

    0000035
    76 followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Appcommvaultcommvault---
OSlinuxlinux_kernel---
OSmicrosoftwindows---

Explore more

Back to dashboardcommvault CVEslinux CVEsmicrosoft CVEscommvault vulnerabilities