# Commvault RCE chain via authentication bypass and path traversal

Published: 2026-06-09 · Severity: elevated · Sectors: government-national, financial-services
Canonical: https://vorant.io/reports/63045b11-4169-55b4-ae5e-f34803165cce/commvault-rce-chain-via-authentication-bypass-and-path-traversal

> Four chained vulnerabilities in Commvault 11.32–11.36 allow unauthenticated remote code execution via authentication bypass and path traversal.

Commvault Backup & Recovery versions 11.32.0–11.32.101 and 11.36.0–11.36.59 contain four vulnerabilities that can be chained to achieve remote code execution. CVE-2025-57788 allows unauthenticated attackers to execute API calls; CVE-2025-57789 permits exploitation of default credentials during the setup phase before the first admin login; CVE-2025-57790 enables path traversal leading to RCE; and CVE-2025-57791 allows command-line injection to bypass authentication. Two separate RCE chains are documented: one exploiting CVE-2025-57788, CVE-2025-57789, and CVE-2025-57790 if the default admin password remains unchanged; a second using CVE-2025-57791 and CVE-2025-57790 against any unpatched instance, including webshell injection. The research was published by watchTowr Labs. No in-the-wild exploitation is reported in the advisory, though affected organizations should patch immediately given the severity of unauthenticated RCE.

## Mentioned in this report

- Vulnerabilities: CVE-2025-57788 (weaponized), CVE-2025-57789 (templated), CVE-2025-57790 (weaponized), CVE-2025-57791 (weaponized)

## Detection guidance (public sample)

### JSP Webshell-Style File Written Under Commvault Directory by Web Process

ATT&CK: T1505.004

A Java/Tomcat process in a Commvault install writing JSP/JSPX files, matching the webshell injection step via path traversal. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: JSP Webshell-Style File Written Under Commvault Directory by Web Process
id: ab30667d-1998-514e-8644-14f325278f69
status: experimental
description: Detects a Java or Tomcat process from a Commvault installation creating
  .jsp/.jspx files inside the Commvault directory tree. The Commvault path traversal
  (CVE-2025-57790) chain allows file writes into web-served locations for webshell
  injection. Generalises on the process, extension and location, not on a specific
  filename.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-commvault-backup-recovery-could-allow-for-remote-code-execution_2025-074
tags:
- attack.persistence
- attack.t1505.004
- attack.initial-access
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection_proc_java:
    Image|contains: \Commvault\
    Image|endswith: \java.exe
  selection_proc_tomcat:
    Image|contains: \Commvault\
    Image|contains|all:
    - tomcat
  selection_file:
    TargetFilename|contains: \Commvault\
    TargetFilename|endswith:
    - .jsp
    - .jspx
  condition: 1 of selection_proc_* and selection_file
falsepositives:
- Commvault software updates or hotfix installs deploying or recompiling JSP files
- Tomcat JSP precompilation or work-directory generation after a service restart
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-commvault-backup-recovery-could-allow-for-remote-code-execution_2025-074

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/63045b11-4169-55b4-ae5e-f34803165cce/commvault-rce-chain-via-authentication-bypass-and-path-traversal.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup