The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has categorized a severe security vulnerability in Commvault Command Center as a Known Exploited Vulnerability. The flaw (CVE-2025-34028) allows remote attackers to execute code via malicious ZIP files, impacting specific versions of the software, which has been patched in later updates. As a result, federal agencies are mandated to ensure patches are applied by May 23, 2025, to safeguard their networks.
Keypoints :
- CVE-2025-34028 is a maximum-severity path traversal vulnerability in Commvault Command Center.
- The flaw affects versions 11.38.0 to 11.38.19 and allows remote, unauthenticated code execution through malicious ZIP files.
- Exploitation is linked to a specific endpoint (“deployWebpackage.do”) that leads to a pre-authenticated Server-Side Request Forgery (SSRF).
- Cybersecurity firm watchTowr Labs reported the vulnerability, which poses a threat to customer data safety.
- Federal Civilian Executive Branch (FCEB) agencies must install patches by May 23, 2025, to mitigate the risk.
Read More: https://thehackernews.com/2025/05/commvault-cve-2025-34028-added-to-cisa.html