Commvault vulnerabilities2 known to be exploited.
Commvault has 15 published vulnerabilities across 25 products in our catalogue. 2 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Commvault, with 7. If you run Commvault software, patch the exploited flaws first.
The most recent Commvault flaw added to the known-exploited list is CVE-2025-34028, on 2 May 2025. We keep watching the known-exploited list.
Which Commvault products have the most vulnerabilities?
Commvault leads with 7 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Commvault vulnerabilities are being exploited?
2 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 10.0Commvault Command Center Path Traversal Vulnerability
Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.
- 8.8Commvault Web Server Unspecified Vulnerability
Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.
Which Commvault flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 97%
The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal...
- 82%CVE-2021-34996High
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22.
- 70%CVE-2017-18044Critical
A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6.
- 69%CVE-2021-34995High
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22.
- 21%CVE-2017-3195Critical
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to arbitrary code execution with...
- 21%CVE-2025-57791Medium
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation.
- 16%CVE-2025-57790High
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue.
- 9.9%CVE-2020-25780High
In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal can occur such that an attempt to view a log file can instead view a file...
- 5.8%CVE-2021-34994High
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22.
- 5.4%CVE-2021-34993Critical
This vulnerability allows remote attackers to bypass authentication on affected installations of Commvault CommCell 11.22.22.
All Commvault products we track.
24 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Commvaultcommvault7 vulnerabilities602 versions
- Commcellcommcell6 vulnerabilities7 versions
- Edgeedge1 vulnerability1 version
- Edge Serveredge_server1 vulnerability1 version
- Active Directory Idataagentactive_directory_idataagent0 vulnerabilities1 version
- Base Clientbase_client0 vulnerabilities1 version
- Commcell Consolecommcell_console0 vulnerabilities1 version
- Commnet Browsercommnet_browser0 vulnerabilities1 version
- Commservecommserve0 vulnerabilities1 version
- Continuous Data Replicatorcontinuous_data_replicator0 vulnerabilities1 version
- Continuous Data Replicator Vss Providercontinuous_data_replicator_vss_provider0 vulnerabilities1 version
- Exchange Database Idataagentexchange_database_idataagent0 vulnerabilities1 version
- Exchange Mailbox Archiver Agentexchange_mailbox_archiver_agent0 vulnerabilities1 version
- Exchange Web Proxy Archiver Agentexchange_web_proxy_archiver_agent0 vulnerabilities1 version
- Exchange Webproxy Archiver Agentexchange_webproxy_archiver_agent0 vulnerabilities1 version
- File System Idataagentfile_system_idataagent0 vulnerabilities1 version
- Media Agentmedia_agent0 vulnerabilities1 version
- Owa Proxy Enablerowa_proxy_enabler0 vulnerabilities1 version
- Resource Packresource_pack0 vulnerabilities1 version
- SQL Server Idataagentsql_server_idataagent0 vulnerabilities1 version
- Srm Exchange Agentsrm_exchange_agent0 vulnerabilities1 version
- Srm Windows File System Agentsrm_windows_file_system_agent0 vulnerabilities1 version
- Vss Providervss_provider0 vulnerabilities1 version
- Windows File System Idataagentwindows_file_system_idataagent0 vulnerabilities1 version
This directory lists the 24 Commvault products with at least one tracked version, of 25 in our catalogue.
Running Commvault? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.
- Matched to
- Commvault on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 15 published vulnerabilities across 25 products and 631 versions from Commvault. The most recent Commvault flaw added to the known-exploited list is CVE-2025-34028, on 2 May 2025.
2 Commvault vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2025-34028 and CVE-2025-3928. The full list is on this page.
Commvault, with 7 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a EdgeProtect account and track the Commvault products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.