CVE-2025-34028 is a path traversal vulnerability in Commvault Command Center that lets an unauthenticated attacker upload a ZIP file disguised as an install package and, when the server expands it, write a malicious JSP file to achieve remote code execution — CISA added it to the KEV catalog within two weeks of disclosure.
Vulnerability summary
10
Critical
97.6%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-04-22
Published
Vulnerability ID: CVE-2025-34028 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Commvault Command Center (Innovation Release) | cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:* | 11.38.0 through 11.38.19 (fixed in 11.38.20 with updates SP38-CU20-433/SP38-CU20-436, and in 11.38.25 with SP38-CU25-434/SP38-CU25-438) |
What this means
CVE-2025-34028 (CWE-22 path traversal, with CWE-306 missing authentication) affects the Commvault Command Center Innovation Release. NVD's description states it "allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP," and specifies the issue affects Command Center Innovation Release 11.38.0 to 11.38.20, fixed in 11.38.20 (via SP38-CU20-433 and SP38-CU20-436) and in 11.38.25 (via SP38-CU25-434 and SP38-CU25-438) (NVD).
NVD's own analysis scores the flaw CVSS v3.1 10.0 (critical, Primary), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, no privileges or user interaction required, scope changed, full impact to confidentiality, integrity and availability. A CVSS v4.0 score of 9.3 was separately submitted by VulnCheck (NVD).
Commvault's own security advisory, CV_2025_04_1, confirms the affected range as Command Center versions 11.38.0 through 11.38.19 on both Linux and Windows, states the flaw "enables attackers to execute arbitrary code without authentication," and directs customers unable to patch immediately to isolate the Command Center installation from external network access; SaaS customers were patched automatically (Commvault Security Advisory CV_2025_04_1).
CISA added CVE-2025-34028 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-05-02, ten days after public disclosure, with a required-action due date of 2025-05-23; security researchers at watchTowr Labs separately published a working pre-authentication exploit chain for the issue (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.97604 (99.902th percentile), reflecting sustained scanning and exploitation activity against internet-facing Command Center installs (FIRST EPSS).
Because the Command Center installer endpoint is reachable without authentication, any instance on an affected build should be patched to 11.38.20/11.38.25 or later immediately, or taken off any network it does not need external access to, and checked for unexpected JSP files given the public exploit chain.
Evidence
- Unauthenticated upload of a ZIP install package to Commvault Command Center, expanded server-side with a path traversal flaw, results in remote code execution via a malicious JSP file. — NVD
- CVSS v3.1 base score is 10.0 (critical, NVD Primary), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H; affects Command Center Innovation Release 11.38.0-11.38.19, fixed in 11.38.20/11.38.25. — NVD
- Commvault's advisory CV_2025_04_1 confirms the affected version range and fixed service-pack updates, and recommends network isolation of unpatched Command Center installs. — Commvault Security Advisory CV_2025_04_1
- Added to the CISA Known Exploited Vulnerabilities catalog on 2025-05-02, due date 2025-05-23. — CISA KEV
- EPSS score is 0.97604 (99.902th percentile) as of 2026-10-29. — FIRST EPSS
