CVE-2021-34996: Commvault CommCell workflow command injection allows SYSTEM code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote code execution as SYSTEM with a very high EPSS score, though no confirmed in-the-wild exploitation or KEV listing is present.

What it is

Commvault CommCell 11.22.22 contains a flaw in the Demo_ExecuteProcessOnGroup workflow that lets an attacker specify an arbitrary command for execution. Authentication is required but the existing authentication mechanism can be bypassed, so the flaw is reachable by remote attackers. Successful exploitation yields code execution as SYSTEM, making it a serious risk to backup infrastructure.

Impact

An attacker gains arbitrary command execution in the context of SYSTEM on the CommCell server, effectively full control of the host and the backup data it manages.

Attack surface

Reached remotely over the network via the workflow functionality; the CVSS vector indicates low privileges are needed and no user interaction, but the description states the authentication mechanism can be bypassed, so effective access may be obtainable without valid credentials.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware usage is documented in the record, but EPSS is very high (0.82258, 99.64th percentile), indicating strong predicted likelihood of exploitation.

What to do

• Apply the vendor patch or fixed Commvault CommCell release for CVE-2021-34996 as the first action.
• Restrict network access to the CommCell server and its web/API interfaces to trusted management networks.
• Audit and remove or disable unnecessary workflow definitions, especially Demo_ExecuteProcessOnGroup, and limit who can create workflows.
• Enforce strong authentication and monitor for authentication bypass attempts against CommCell.
• Run the CommCell service with least privilege where the product allows, rather than SYSTEM.

Detection

• Monitor CommCell and Windows event logs for creation or modification of Demo_ExecuteProcessOnGroup workflows.
• Alert on child processes spawned by CommCell services, particularly cmd.exe, powershell.exe or other shells running as SYSTEM.
• Review network logs for unexpected external connections to CommCell management ports.
• Correlate authentication events with workflow creation activity to spot bypass attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.