Commvault RCE chain via authentication bypass and path traversal
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Four chained vulnerabilities in Commvault 11.32–11.36 allow unauthenticated remote code execution via authentication bypass and path traversal.
Commvault Backup & Recovery versions 11.32.0–11.32.101 and 11.36.0–11.36.59 contain four vulnerabilities that can be chained to achieve remote code execution. CVE-2025-57788 allows unauthenticated attackers to execute API calls; CVE-2025-57789 permits exploitation of default credentials during the setup phase before the first admin login; CVE-2025-57790 enables path traversal leading to RCE; and CVE-2025-57791 allows command-line injection to bypass authentication. Two separate RCE chains are documented: one exploiting CVE-2025-57788, CVE-2025-57789, and CVE-2025-57790 if the default admin password remains unchanged; a second using CVE-2025-57791 and CVE-2025-57790 against any unpatched instance, including webshell injection. The research was published by watchTowr Labs. No in-the-wild exploitation is reported in the advisory, though affected organizations should patch immediately given the severity of unauthenticated RCE.
Mentioned in this report
Detection guidance
JSP Webshell-Style File Written Under Commvault Directory by Web Process
A Java/Tomcat process in a Commvault install writing JSP/JSPX files, matching the webshell injection step via path traversal. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: JSP Webshell-Style File Written Under Commvault Directory by Web Process
id: ab30667d-1998-514e-8644-14f325278f69
status: experimental
description: Detects a Java or Tomcat process from a Commvault installation creating
.jsp/.jspx files inside the Commvault directory tree. The Commvault path traversal
(CVE-2025-57790) chain allows file writes into web-served locations for webshell
injection. Generalises on the process, extension and location, not on a specific
filename.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-commvault-backup-recovery-could-allow-for-remote-code-execution_2025-074
tags:
- attack.persistence
- attack.t1505.004
- attack.initial-access
- attack.t1190
logsource:
category: file_event
product: windows
detection:
selection_proc_java:
Image|contains: \Commvault\
Image|endswith: \java.exe
selection_proc_tomcat:
Image|contains: \Commvault\
Image|contains|all:
- tomcat
selection_file:
TargetFilename|contains: \Commvault\
TargetFilename|endswith:
- .jsp
- .jspx
condition: 1 of selection_proc_* and selection_file
falsepositives:
- Commvault software updates or hotfix installs deploying or recompiling JSP files
- Tomcat JSP precompilation or work-directory generation after a service restart
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-commvault-backup-recovery-could-allow-for-remote-code-execution_2025-074
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs