CVE-2025-57788: 
Commvault vulnerability analysis and mitigation

CVE-2025-57788 is an authentication bypass vulnerability in Commvault's login mechanism that allows unauthenticated attackers to execute API calls without providing valid credentials. Classified under CWE-259 (Use of Hard-coded Password), it affects Commvault versions before 11.36.60, including CommCell versions 11.32.0–11.32.101 and 11.36.0–11.36.59. The vulnerability was published on August 20, 2025, with a patch released the same day. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (Commvault Advisory, ENISA EUVD).

The root cause is an argument injection vulnerability in Commvault's DoRemoteCSLogin code path, which is reachable by supplying a commserver value different from the actual server hostname in the JSON login body (CWE-259). The .NET backend constructs qlogin command arguments via unsanitized string formatting, allowing an attacker to inject the -localadmin flag into the password field (base64-encoded as a -localadmin) and bypass the hostname check in the commserver field by appending an extra -cs argument. Because qlogin is ultimately executed by a dotnet.exe process running as NT AUTHORITY\SYSTEM, the -localadmin switch succeeds and returns a valid high-privileged API token without any credentials. The target hostname needed to craft the payload can be leaked unauthenticated via GET /commandcenter/publicLink.do. This vulnerability is part of a second pre-auth RCE chain that also involves CVE-2025-57788 (credential leak of _PublicSharingUser_), CVE-2025-57791 (hard-coded encryption key for privilege escalation), and CVE-2025-57790 (post-auth RCE via path traversal) (watchTowr Labs).

Successful exploitation allows an unauthenticated remote attacker to obtain a valid, high-privileged localadmin API token, effectively bypassing all authentication controls. While RBAC limits some exposure, the token grants broad access to Commvault's 5,600+ internal API endpoints, enabling unauthorized access to backup data, system configurations, and potentially sensitive credentials stored within the platform. When chained with CVE-2025-57790 (post-auth RCE via path traversal), this vulnerability enables full pre-authentication remote code execution on the Commvault server, which — as a backup and replication platform — typically has privileged access to a wide range of enterprise systems, making lateral movement highly feasible (watchTowr Labs, Commvault Advisory).

A public proof-of-concept exploit was published by watchTowr Labs on August 20, 2025, the same day as disclosure, demonstrating the full pre-auth RCE chain (watchTowr Labs). A Metasploit module (commvault_rce_cve_2025_57790_cve_2025_57791) was added to the Rapid7 framework in September 2025, further lowering the exploitation barrier (Rapid7 Blog). Nuclei detection templates have also been published by ProjectDiscovery. The EPSS score is approximately 0.022, and no specific threat actor attribution or CISA KEV listing has been confirmed for this CVE at this time. Detection signatures are available from Qualys (ID 732941), Nessus (ID 253649), and FortiGuard IPS.

1. Reconnaissance: Identify internet-facing Commvault instances (port 443) using Shodan or Censys. Confirm the version is below 11.36.60.
2. Leak the hostname: Send an unauthenticated GET /commandcenter/publicLink.do request to the target. Extract the CommServe hostname from the response (e.g., from "activeMQConnectionURL":"tcp://WIN-AC7GJT5:8052").
3. Craft the bypass payload: Construct a login JSON body with:
   • username: <hostname>_localadmin__ (e.g., WIN-AC7GJT5_localadmin__)
   • password: YSAtbG9jYWxhZG1pbg== (base64 of a -localadmin)
   • commserver: <hostname> -cs <hostname> (e.g., WIN-AC7GJT5 -cs WIN-AC7GJT5)
4. Send the authentication request: POST the crafted JSON to /commandcenter/api/Login. The backend forwards this to the .NET API, which constructs an unsanitized qlogin command string injecting -localadmin, executed as SYSTEM via dotnet.exe.
5. Obtain privileged token: The response returns a valid localadmin API token (QSDK ...) without requiring any credentials.
6. Chain for RCE (optional): Use the obtained token with CVE-2025-57790 (path traversal in QCommand output writer) to drop a JSP webshell into the Commvault webroot and achieve remote code execution (watchTowr Labs, Rapid7 Blog).

• Network: Unauthenticated GET requests to /commandcenter/publicLink.do from external IPs (hostname enumeration); POST requests to /commandcenter/api/Login with a commserver field containing a space and repeated hostname (e.g., WIN-AC7GJT5 -cs WIN-AC7GJT5); unusual API calls using QSDK tokens from unexpected source IPs.
• Logs: Commvault access logs showing login attempts with commserver values containing -cs argument injection patterns; successful localadmin token generation events without corresponding valid user credentials; qlogin invocations with -localadmin flag in process audit logs.
• Process: Unexpected child processes spawned by dotnet.exe or w3wp.exe (e.g., cmd.exe, powershell.exe, curl); qlogin executed with -localadmin argument from a network-facing process context.
• File System: New or modified JSP files in the Commvault webroot (if chained with CVE-2025-57790 for RCE); unexpected scripts or executables in Commvault installation directories.
• Detection Rules: Sigma rule available at detection.fyi/sigmahq/sigma/emerging-threats/2025/exploits/cve-2025-57788/proc_creation_win_exploit_cve_2025_57788; Nuclei templates published by ProjectDiscovery (watchTowr Labs).

Commvault has released a patch in version 11.36.60, which addresses CVE-2025-57788 and the related vulnerabilities in the pre-auth RCE chains. Organizations should immediately upgrade to Commvault 11.36.60 or later (Commvault Advisory). As interim mitigations, restrict external network access to Commvault management interfaces, review and harden RBAC configurations, implement network segmentation to limit exposure of the Commvault server, and monitor API access logs for suspicious localadmin token generation or anomalous commserver field values in login requests.

The watchTowr Labs team (Piotr Bazydlo and Sonny) published a detailed technical blog on August 20, 2025, describing the full pre-auth RCE chains and noting that Commvault — as a high-value backup platform trusted by large enterprises — represents a prime target for ransomware and APT groups (watchTowr Labs). The vulnerability received broad media coverage from The Register, The Hacker News, Help Net Security, and Computer Weekly, with headlines emphasizing the pre-auth RCE risk (The Register, The Hacker News). The Canadian Centre for Cyber Security (CCCS) and CIS both issued advisories urging immediate patching (CCCS Advisory, CIS Advisory). Community discussion on Reddit and Mastodon highlighted the severity of the chained exploitation scenario, with security researchers drawing parallels to previous high-impact Veeam vulnerabilities.