CVE-2025-57791: 
Commvault vulnerability analysis and mitigation

CVE-2025-57791 is an argument injection vulnerability in Commvault (CWE-88) that allows remote, unauthenticated attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. Successful exploitation results in a valid user session for a low-privilege role. It affects Commvault versions before 11.36.60, including CommCell versions 11.32.0–11.32.101 and 11.36.0–11.36.59. The vulnerability was published on August 20, 2025, with a patch released the same day. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (Commvault Advisory, Red Hat CVE).

The root cause is CWE-88 (Improper Neutralization of Argument Delimiters in a Command — Argument Injection): user-supplied input is not properly sanitized before being passed as arguments to internal Commvault components, allowing an attacker to inject additional or modified arguments. The attack vector is network-based, requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable from the internet. When chained with a companion vulnerability (CVE-2025-57790), the two flaws form a pre-authentication remote code execution (RCE) exploit chain, as detailed in watchTowr's technical write-up (watchTowr Labs). A Metasploit module combining both CVEs is publicly available (Metasploit Module).

Standalone exploitation of CVE-2025-57791 grants an attacker a valid low-privilege user session within the Commvault environment, resulting in limited confidentiality and integrity impact with no direct availability impact. However, when chained with CVE-2025-57790, the combined exploit enables full pre-authentication remote code execution on the Commvault server, potentially allowing complete system compromise, access to backup data (which may include credentials and sensitive enterprise data), and lateral movement within the network (watchTowr Labs, Field Effect Blog).

A Metasploit module targeting both CVE-2025-57790 and CVE-2025-57791 was added to the Metasploit Framework on September 16, 2025, making weaponized exploitation readily accessible (Metasploit Module). Proof-of-concept exploitation details were also documented by watchTowr Labs and BeyondMachines (watchTowr Labs, BeyondMachines). The EPSS score is approximately 0.165%, and no specific threat actor attribution or CISA KEV listing has been identified for this CVE at this time. Detection plugins are available from Qualys (ID: 732941) and Nessus (ID: 253649).

1. Reconnaissance: Identify internet-facing Commvault CommCell servers running versions before 11.36.60 using tools like Shodan or Censys, targeting the Commvault web service port (typically TCP 443 or 80).
2. Trigger argument injection (CVE-2025-57791): Send a crafted unauthenticated HTTP request to a vulnerable Commvault endpoint, injecting malicious argument delimiters into user-controlled input fields that are passed to internal command-line components without proper sanitization.
3. Obtain low-privilege session: The injected arguments manipulate the internal component's behavior, resulting in the server returning a valid session token for a low-privilege Commvault user role.
4. Chain with CVE-2025-57790: Use the obtained low-privilege session to exploit CVE-2025-57790 (a separate vulnerability in the same advisory), escalating to remote code execution on the Commvault server.
5. Achieve RCE: Execute arbitrary commands on the Windows host running Commvault, enabling deployment of payloads, credential harvesting from backup data, or lateral movement. The full chain is implemented in the public Metasploit module (Metasploit Module, watchTowr Labs).

• Network: Unexpected unauthenticated HTTP requests to Commvault web service endpoints with anomalous argument-delimiter characters (e.g., --, -, spaces in unusual parameter positions); outbound connections from the Commvault server to unknown external IPs following such requests.
• Logs: Commvault access logs showing unauthenticated requests that result in session token issuance for low-privilege accounts; error or debug log entries related to unexpected command-line argument parsing in internal Commvault processes.
• File System: Presence of YARA-detectable artifacts associated with CVE-2025-57791 exploitation (see Neo23x0 YARA rule); unexpected scripts, executables, or web shells in Commvault installation directories.
• Process: Unusual child processes spawned by Commvault service processes (e.g., cmd.exe, powershell.exe, net.exe) detectable via Sigma rule (Sigma Rule).
• Authentication: Unexpected low-privilege Commvault user sessions created without corresponding legitimate login activity in audit logs.

Commvault has released a patch in version 11.36.60, which resolves the argument injection vulnerability; organizations should upgrade immediately (Commvault Advisory). As interim measures, restrict network access to Commvault systems so that only authorized hosts can reach the web service interface, and implement strict input validation monitoring. Organizations should also apply IPS signatures from FortiGuard (version 34.079+), Check Point (CPAI-2025-1224), and Citrix NetScaler WAF (v160 r1181) where available. Qualys (QID 732941) and Nessus (plugin 253649) can be used to detect vulnerable instances.

watchTowr Labs published a detailed technical blog titled "Guess Who Would Be Stupid Enough to Rob the Same Vault Twice" on August 20, 2025, demonstrating the pre-auth RCE exploit chain combining CVE-2025-57791 and CVE-2025-57790 (watchTowr Labs). The story received broad coverage from The Hacker News, The Register, Computer Weekly, and Help Net Security, with The Register noting that Commvault users were urged to patch two RCE exploit chains (The Register, The Hacker News). The CIS and Canadian Centre for Cyber Security (CCCS) both issued advisories, and the vulnerability was featured in The Hacker News weekly recap alongside other high-profile flaws. Community discussion on Mastodon and Bluesky highlighted the severity of the pre-auth RCE chain and the rapid availability of a Metasploit module.