[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTlJMhBJNHB1nhFJrVCICqO_hpXSSz9jbwTfSu_1wcIY":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":100,"kevVulnerabilities":155,"topProductsByCves":169,"seoMetadata":180,"meta":189},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":99},6094,"commvault",25,15,2,631,"2025-08-20","c",[16,20,26,31,35,39,42,45,48,51,54,57,60,63,66,69,72,75,78,81,84,87,90,93,96],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},28805,602,7,{"id":21,"product_name":22,"version_count":19,"cve_count":23,"kev_count":24,"last_cve_update":25},28801,"commcell",6,0,"2022-01-13",{"id":27,"product_name":28,"version_count":29,"cve_count":29,"kev_count":24,"last_cve_update":30},28808,"edge",1,"2017-12-16",{"id":32,"product_name":33,"version_count":29,"cve_count":29,"kev_count":24,"last_cve_update":34},28809,"edge_server","2015-11-04",{"id":36,"product_name":37,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28804,"commserve",null,{"id":40,"product_name":41,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28806,"continuous_data_replicator",{"id":43,"product_name":44,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28807,"continuous_data_replicator_vss_provider",{"id":46,"product_name":47,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28810,"exchange_database_idataagent",{"id":49,"product_name":50,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28811,"exchange_mailbox_archiver_agent",{"id":52,"product_name":53,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28812,"exchange_web_proxy_archiver_agent",{"id":55,"product_name":56,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28813,"exchange_webproxy_archiver_agent",{"id":58,"product_name":59,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28814,"file_system_idataagent",{"id":61,"product_name":62,"version_count":24,"cve_count":24,"kev_count":24,"last_cve_update":38},28815,"galaxy",{"id":64,"product_name":65,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28816,"media_agent",{"id":67,"product_name":68,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28817,"owa_proxy_enabler",{"id":70,"product_name":71,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28818,"resource_pack",{"id":73,"product_name":74,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28819,"sql_server_idataagent",{"id":76,"product_name":77,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28820,"srm_exchange_agent",{"id":79,"product_name":80,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28821,"srm_windows_file_system_agent",{"id":82,"product_name":83,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28822,"vss_provider",{"id":85,"product_name":86,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28799,"active_directory_idataagent",{"id":88,"product_name":89,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28823,"windows_file_system_idataagent",{"id":91,"product_name":92,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28800,"base_client",{"id":94,"product_name":95,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28802,"commcell_console",{"id":97,"product_name":98,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},28803,"commnet_browser","Commvault is a technology vendor with 25 tracked products and 15 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[101,109,116,120,127,131,137,141,147,151],{"cveId":102,"description":103,"publishedDate":104,"cvssScore":105,"cvssVersion":106,"severity":107,"isKev":4,"epssScore":108},"CVE-2025-34028","The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.\n\n\n\n\n\nThis issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.","2025-04-22",10,"v3.1","Critical",0.97604,{"cveId":110,"description":111,"publishedDate":25,"cvssScore":112,"cvssVersion":106,"severity":113,"isKev":114,"epssScore":115},"CVE-2021-34996","This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Demo_ExecuteProcessOnGroup workflow. By creating a workflow, an attacker can specify an arbitrary command to be executed. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-13889.",8.8,"High",false,0.82258,{"cveId":117,"description":118,"publishedDate":25,"cvssScore":112,"cvssVersion":106,"severity":113,"isKev":114,"epssScore":119},"CVE-2021-34995","This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the DownloadCenterUploadHandler class. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-13756.",0.68864,{"cveId":121,"description":122,"publishedDate":123,"cvssScore":124,"cvssVersion":125,"severity":107,"isKev":114,"epssScore":126},"CVE-2017-18044","A Command Injection issue was discovered in ContentStore\u002FBase\u002FCVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvault service does not properly validate the input of an incoming string before passing it to CreateProcess. As a result, a specially crafted message can inject commands that will be executed on the target operating system. Exploitation of this vulnerability does not require authentication and can lead to SYSTEM level privilege on any system running the cvd daemon. This is a different vulnerability than CVE-2017-3195.","2018-01-19",9.8,"v3.0",0.68732,{"cveId":128,"description":129,"publishedDate":13,"cvssScore":112,"cvssVersion":106,"severity":113,"isKev":114,"epssScore":130},"CVE-2025-57790","A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. The vulnerability may lead to remote code execution.",0.43879,{"cveId":132,"description":133,"publishedDate":13,"cvssScore":134,"cvssVersion":106,"severity":135,"isKev":114,"epssScore":136},"CVE-2025-57791","A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. Successful exploitation results in a valid user session for a low privilege role.",6.5,"Medium",0.38788,{"cveId":138,"description":139,"publishedDate":30,"cvssScore":124,"cvssVersion":106,"severity":107,"isKev":114,"epssScore":140},"CVE-2017-3195","Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to arbitrary code execution with administrative privileges.",0.21387,{"cveId":142,"description":143,"publishedDate":144,"cvssScore":145,"cvssVersion":106,"severity":113,"isKev":114,"epssScore":146},"CVE-2020-25780","In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal can occur such that an attempt to view a log file can instead view a file outside of the log-files folder.","2020-10-29",7.5,0.09884,{"cveId":148,"description":149,"publishedDate":13,"cvssScore":134,"cvssVersion":106,"severity":135,"isKev":114,"epssScore":150},"CVE-2025-57788","A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.",0.07762,{"cveId":152,"description":153,"publishedDate":25,"cvssScore":112,"cvssVersion":106,"severity":113,"isKev":114,"epssScore":154},"CVE-2021-34994","This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the DataProvider class. The issue results from the lack of proper validation of a user-supplied string before executing it as JavaScript code. An attacker can leverage this vulnerability to escape the JavaScript sandbox and execute Java code in the context of NETWORK SERVICE. Was ZDI-CAN-13755.",0.05789,[156,161],{"cveId":102,"description":103,"publishedDate":104,"cvssScore":105,"cvssVersion":106,"severity":107,"isKev":4,"epssScore":108,"cisaVulnName":157,"cisaDateAdded":158,"cisaShortDescription":159,"cisaRequiredAction":160},"Commvault Command Center Path Traversal Vulnerability","2025-05-02","Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":162,"description":163,"publishedDate":164,"cvssScore":112,"cvssVersion":106,"severity":113,"isKev":4,"epssScore":165,"cisaVulnName":166,"cisaDateAdded":167,"cisaShortDescription":168,"cisaRequiredAction":160},"CVE-2025-3928","Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: \"Webservers can be compromised through bad actors creating and executing webshells.\" Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.","2025-04-25",0.02527,"Commvault Web Server Unspecified Vulnerability","2025-04-28","Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.",[170,171,172,173,174,175,176,177,178,179],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},{"id":21,"product_name":22,"version_count":19,"cve_count":23,"kev_count":24,"last_cve_update":25},{"id":27,"product_name":28,"version_count":29,"cve_count":29,"kev_count":24,"last_cve_update":30},{"id":32,"product_name":33,"version_count":29,"cve_count":29,"kev_count":24,"last_cve_update":34},{"id":36,"product_name":37,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},{"id":40,"product_name":41,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},{"id":43,"product_name":44,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},{"id":46,"product_name":47,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},{"id":49,"product_name":50,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},{"id":52,"product_name":53,"version_count":29,"cve_count":24,"kev_count":24,"last_cve_update":38},{"title":181,"metaDescription":182,"keywords":183,"structuredData":184},"Commvault - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Commvault covering 25 products with 15 tracked vulnerabilities including 1 critical and 1 high-severity issues and 2 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Commvault vulnerabilities, Commvault security, Commvault CVE, Commvault threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Commvault KEV, Commvault exploited vulnerabilities",{"@context":185,"@type":186,"name":187,"description":182,"url":188},"https:\u002F\u002Fschema.org","Organization","Commvault","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Fcommvault",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":190,"apiVersion":191},"2026-10-28T16:05:36.662Z","3.0"]