CVE-2025-57790: 
Commvault vulnerability analysis and mitigation

CVE-2025-57790 is an absolute path traversal vulnerability in Commvault (CWE-36) that allows remote attackers with low-level privileges to perform unauthorized file system access, potentially leading to remote code execution. It affects Commvault versions before 11.36.60, specifically including CommCell versions 11.32.0–11.32.101 and 11.36.0–11.36.59. The vulnerability was published on August 20, 2025, with a patch advisory released on August 21, 2025. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (Commvault Advisory, Red Hat CVE).

The root cause is an improper limitation of file path handling (CWE-36: Absolute Path Traversal), which allows attackers to supply absolute paths that bypass intended directory restrictions and access arbitrary files on the underlying file system. Exploitation requires only low-level network authentication (no user interaction), making it accessible to any authenticated user on the Commvault platform. CVE-2025-57790 is chained with a companion vulnerability (CVE-2025-57791) to form a pre-authentication remote code execution exploit chain, as detailed in a technical write-up by watchTowr Labs (watchTowr Labs). A Metasploit module combining both CVEs was published in September 2025 (Metasploit Module).

Successful exploitation grants attackers unauthorized read and write access to the file system of the Commvault server, with high impact to confidentiality, integrity, and availability. When chained with CVE-2025-57791, the vulnerability enables pre-authentication remote code execution, allowing full system compromise without valid credentials. Given that Commvault is a backup and data management platform, exploitation could expose sensitive backup data, credentials, and configuration files, and could facilitate lateral movement across the enterprise environment (watchTowr Labs, The Hacker News).

A fully weaponized Metasploit module (combining CVE-2025-57790 and CVE-2025-57791) was added to the Metasploit Framework on September 16, 2025, and is publicly available (Metasploit Module, Rapid7 Wrap-up). The exploit chain enables pre-authentication RCE, significantly lowering the barrier for exploitation. The EPSS score is approximately 0.32%, and there is no current listing in the CISA KEV catalog. Detection plugins are available via Qualys (ID: 732941) and Nessus (ID: 253649), and a Sigma detection rule has been published (SigmaHQ).

1. Reconnaissance: Identify internet-facing Commvault CommCell servers running versions before 11.36.60 using network scanning tools (e.g., Shodan, Censys) or internal asset inventories.
2. Chain with CVE-2025-57791: Use the companion vulnerability (CVE-2025-57791) to bypass authentication requirements, enabling pre-auth access to the Commvault web interface or API endpoints.
3. Trigger path traversal: Send a crafted HTTP request to a vulnerable Commvault endpoint, supplying an absolute path (e.g., C:\Windows\System32\... or /etc/passwd) in a parameter that is not properly sanitized, exploiting the CWE-36 flaw.
4. Read/write arbitrary files: Leverage the path traversal to read sensitive configuration files, credentials, or write a malicious payload (e.g., a web shell or executable) to a location accessible by the Commvault service.
5. Achieve remote code execution: Execute the dropped payload or leverage written files to trigger code execution under the Commvault service account context, achieving full system compromise.
6. Lateral movement: Use harvested credentials or access to backup data to pivot to other systems in the environment (watchTowr Labs, Metasploit Module).

• Network: Unusual HTTP requests to Commvault web endpoints containing absolute path strings (e.g., C:\, /etc/, ..\..\) in parameters; unexpected outbound connections from the Commvault server to external IPs.
• Logs: Commvault access logs showing requests with path traversal patterns or absolute paths in file-related API parameters; authentication anomalies consistent with CVE-2025-57791 exploitation preceding file access events.
• File System: Unexpected files (e.g., web shells, executables) written to Commvault installation directories or web-accessible paths; modification timestamps on system files inconsistent with normal operations.
• Process: Unusual child processes spawned by the Commvault service (e.g., cmd.exe, powershell.exe, net.exe) — detectable via the published Sigma rule (SigmaHQ).
• Scanner Detections: Alerts from Qualys QID 732941 or Nessus plugin 253649 indicating vulnerable Commvault versions.

Commvault has released a patch in version 11.36.60, which resolves CVE-2025-57790. Organizations running CommCell versions 11.32.0–11.32.101 or 11.36.0–11.36.59 should upgrade immediately. As interim mitigations, implement network segmentation to restrict access to Commvault management interfaces, apply the principle of least privilege to Commvault service accounts, and monitor network traffic for suspicious file system access patterns (Commvault Advisory, CIS Advisory).

watchTowr Labs published a detailed technical write-up titled "Guess Who Would Be Stupid Enough to Rob the Same Vault Twice" documenting the pre-auth RCE exploit chains, which drew significant community attention (watchTowr Labs). The Register, The Hacker News, Computer Weekly, and Help Net Security all covered the disclosure, emphasizing the severity of the chained pre-auth RCE scenario (The Register, The Hacker News). The Canadian Centre for Cyber Security and CIS both issued advisories urging immediate patching (Canadian CCCS, CIS Advisory). Social media activity on Mastodon and X (via DarkWebInformer) highlighted the public exploit availability and urged defenders to prioritize patching.