CVE-2025-34028Added 2 May 2025
Commvault Command Center Path Traversal Vulnerability
Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.
CISA entry
← Search results
AUTOMATICALLY VERIFIEDOFFICIAL VENDOR SOURCECOLLECTED 12 SEP 2026
Commvault · AUTOMATIC DISCOVERY
Commvault 11.40
Commvault is tracked by BlackTree as an end-user software application. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.
This record passed BlackTree's automatic primary-source checks with a confidence score of 96. It is returned for operational research without requiring routine manual approval. Confirm edition and deployment applicability before acting.
Product overview
Commvault is tracked by BlackTree as an end-user software application. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.
Main capabilities
- User-facing application functions
- Local or managed application deployment
- Vendor-maintained feature and security updates
Typical use
Used by individuals or organizations for the product-specific tasks described by its publisher.
Deployment
Installed on supported endpoints or supplied through a vendor-managed service, depending on the edition.
This category-level context is generated from the registered product identity. Confirm exact product capabilities on the publisher's page .
Collected lifecycle data
| Product | Commvault |
|---|---|
| Release | 11.40 |
| End of Support | 15 December 2027 |
| Date precision | Day |
Known exploited vulnerabilities
Catalogue updated 11 Sep 2026These are product-family matches in the CISA Known Exploited Vulnerabilities catalogue. Confirm the affected product version in the vendor advisory.
CVE-2025-3928Added 28 Apr 2025
Commvault Web Server Unspecified Vulnerability
Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.
CISA entryPackage vulnerability advisories
OSV advisories are matched through the registered package URL. A package-family match does not prove that the installed release is affected. Check the affected and fixed versions before remediation.
No package advisories have been linked for this product identity.
This is not evidence that the product has no vulnerabilities.
Source evidence
PRIMARYManual
Commvault official lifecycle source
Release | Release type | Initial release date | Latest maintenance release | Maintenance release date | End-of-life date | 11.40 | Long-term support | June 15, 2025 | 11.40.72 | September 01, 2026 | December 15, 2027
Publisher identity used by product-specific official-source collectors.
Open official vendor source