Commvault Catastrophe: Critical Flaw Hits Maximum-Security Alert!

CISA has added a critical security flaw CVE-2025-34028 to its Known Exploited Vulnerabilities catalog. This path traversal bug in Commvault Command Center lets attackers upload ZIP files for remote code execution. It’s the second Commvault flaw weaponized in the wild, urging agencies to patch up by May 23, 2025.

3P
Published: May 5, 2025 5:46 pmAdded: May 5, 2025 at 11:05 amAssembled by: The Editor
Pro Dashboard

Hot Take:

Looks like Commvault’s Command Center is trying to command a little too much attention! If it keeps this up, it’ll be the drama queen of the cybersecurity world. Hey Commvault, how about less path traversal and more path to recovery?

Key Points:

  • CISA adds a critical Commvault Command Center vulnerability to its KEV catalog.
  • The flaw, CVE-2025-34028, scores a perfect 10.0 on the CVSS scale.
  • Path traversal vulnerability enables remote code execution via malicious ZIP files.
  • watchTowr Labs discovered the bug, associated with “deployWebpackage.do” endpoint.
  • Federal agencies must patch the vulnerability by May 23, 2025.

Membership Required

 You must be a member to access this content.

View Membership Levels
Already a member? Log in here
The Nimble Nerd
powered by the NSA, er,  GDPR Cookie Compliance
Confessional Booth of Our Digital Sins

Okay, deep breath, let's get this over with. In the grand act of digital self-sabotage, we've littered this site with cookies. Yep, we did that. Why? So your highness can have a 'premium' experience or whatever. These traitorous cookies hide in your browser, eagerly waiting to welcome you back like a guilty dog that's just chewed your favorite shoe. And, if that's not enough, they also tattle on which parts of our sad little corner of the web you obsess over. Feels dirty, doesn't it?