Commvault’s Comedy of Vulnerabilities: Four Security Gaps Exposed (But Now Closed!)
Commvault’s latest updates tackle four security gaps that could lead to remote code execution, with vulnerabilities reminiscent of a tech horror movie. Researchers revealed the bugs, and they’re now patched, but remember, always change that default admin password. Commvault SaaS users can relax, as they’re unaffected by this thriller.
Hot Take:
Commvault might not be the vault of security they hoped to be, but hey, at least they’re patching up the holes. It’s like discovering your vault is made of cheese, but don’t worry, they’ve got the crackers to go with it! After all, nothing says “secure” quite like a virtual Swiss cheese firewall.
Key Points:
- Commvault addressed four vulnerabilities in versions prior to 11.36.60.
- The vulnerabilities include flaws that allow unauthorized API calls, path traversal, and command-line argument manipulation.
- Two exploit chains leveraging these vulnerabilities can lead to remote code execution.
- watchTowr Labs researchers discovered these vulnerabilities in April 2025.
- Commvault’s SaaS solution remains unaffected, and updates have been released to address these issues.
Already a member? Log in here