CVE-2017-18044: Commvault CVDataPipe.dll unauthenticated command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable command injection yielding SYSTEM on backup infrastructure, with public exploit tooling and very high EPSS.

What it is

The message parsing function in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6 fails to validate an incoming string before passing it to CreateProcess. A crafted message therefore injects OS commands executed by the cvd daemon. Unauthenticated remote code execution against a backup server makes this a serious exposure.

Impact

An unauthenticated attacker can execute arbitrary commands on the target host and, per the advisory, reach SYSTEM level privilege on any system running the cvd daemon.

Attack surface

Reached over the network by sending a specially crafted message to the Commvault service; the CVSS vector (AV:N/PR:N/UI:N) and description state no authentication or user interaction is required.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.69753, 99.3rd percentile) and references include a Metasploit module tagged Exploit, indicating public exploit tooling exists.

What to do

• Upgrade Commvault to v11 SP6 or later, which the advisory states fixes the flaw.
• Restrict network access to the cvd daemon and Commvault service ports to trusted management hosts only.
• Run the Commvault service with least privilege where the product allows, rather than SYSTEM.
• Monitor vendor advisories for this product line and apply subsequent security updates promptly.

Detection

• Alert on unexpected child processes spawned by the Commvault cvd daemon, especially cmd.exe or shells.
• Monitor network traffic to Commvault service ports from untrusted or unusual sources.
• Review Commvault service logs for malformed or anomalous message parsing errors preceding process creation.
• Baseline normal cvd daemon process behavior and flag deviations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.