CVE-2025-34028: Commvault Command Center unauthenticated ZIP upload path traversal RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a public exploit, CISA KEV listing and near-certain EPSS score makes this an urgent patch-first issue.

What it is

Commvault Command Center Innovation Release accepts unauthenticated uploads of ZIP install packages that are expanded without safe path handling, allowing path traversal. An attacker can write a malicious JSP outside the intended directory and achieve remote code execution on the server. The flaw affects versions 11.38.0 through 11.38.20 and is fixed in 11.38.20 and 11.38.25 maintenance updates.

Impact

An unauthenticated attacker gains remote code execution on the Command Center server, enabling full compromise of the host and any data or credentials it can reach. Because the product is a backup and data management platform, this can expose or destroy protected backup data.

Attack surface

Reachable over the network via the Command Center web interface with no authentication and no user interaction, per the CVSS 4.0 vector (AV:N/PR:N/UI:N). The attacker only needs to submit a crafted ZIP install package to the upload function.

Exploitation

CVE-2025-34028 is listed in CISA KEV with a 2025-05-23 remediation due date, and EPSS gives a 30-day probability of 0.977 (99.9th percentile). A public proof-of-concept exploit is referenced, so active exploitation should be assumed.

What to do

• Upgrade to 11.38.20 with SP38-CU20-433 and SP38-CU20-436, or to 11.38.25 with SP38-CU25-434 and SP38-CU25-438, as directed by the vendor advisory.
• If patching cannot be completed immediately, restrict network access to the Command Center interface to trusted management networks only.
• Follow CISA BOD 22-01 guidance for cloud services and apply the vendor mitigations or discontinue use where mitigations are unavailable.
• Review and remove any unexpected JSP files or install packages written to the Command Center web directories.
• Rotate credentials and secrets stored on or reachable from the Command Center host if compromise is suspected.

Detection

• Monitor Command Center logs and web server access logs for unauthenticated POST requests to install package or upload endpoints.
• Alert on new or modified JSP files appearing in Command Center web-accessible directories outside expected deployment paths.
• Hunt for ZIP archives containing path traversal sequences (../) or JSP payloads submitted to the Command Center service.
• Correlate unexpected child processes spawned by the Command Center web service, which may indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.