Commvault - 14 CVEs (Page 1/1)

About “Commvault”

A curated feed of “Commvault”-related CVEs appears below. We currently track 14 CVEs for this tag (all time). In the last 365 days, 3 were published. Average CVSS is 8.9 (all time; 8.0 over 365d), and 93% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE-427 - Uncontrolled Search Path Element, CWE-269 - Improper Privilege Management.

In our taxonomy this topic maps to a MODERATE impact class. Backup and DR systems hold credentials and full data copies. Patch promptly, validate backup and restore paths, restrict admin access, and encrypt repositories. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.

Support & lifecycle: commvault

This table shows recent release cycles and their projected end-of-life. Data source: endoflife.date.

Cycle	Release	Latest	EOL	LTS
11.42	2025-07-14	11.42.90	2026-07-15 Soon
11.40	2025-06-15	11.40.51	2027-12-15	LTS
11.38	2025-02-15	11.38.37	2025-07-18 Expired
11.36	2024-08-15	11.36.102	2027-06-15	LTS
11.32	2023-08-15	11.32.139	2026-06-15 Soon	LTS

Maintained Soon (≤ 180 days) Expired

Subscribe lifecycle: RSS · RSS (expired) · ICS

Subscribe CVEs: RSS for “Commvault” · RSS (High+Critical only)

CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).

CVSS ≥ 0.0

2025-07-25

Medium

CVE-2025-34136

An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL In…

CVSS: 6.9 CWE: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') View on NVD

High

CVE-2024-13976

A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates, an attacker with local access may exploi…

CVSS: 8.5 CWE: CWE-427 - Uncontrolled Search Path Element View on NVD

High

CVE-2024-13975

A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations, a local attacker who owns a client sys…

CVSS: 8.5 CWE: CWE-269 - Improper Privilege Management View on NVD

2025-04-25

High

CVE-2025-3928

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors…

CVSS: 8.8 CWE: N/A View on NVD

2025-04-22

Critical

CVE-2025-34028

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path tr…

CVSS: 10.0 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') View on NVD

2022-01-13

High

CVE-2021-34997

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the e…

CVSS: 8.8 CWE: CWE-434 - Unrestricted Upload of File with Dangerous Type View on NVD

High

CVE-2021-34996

CVSS: 8.8 CWE: CWE-749 - Exposed Dangerous Method or Function View on NVD

High

CVE-2021-34995

CVSS: 8.8 CWE: CWE-434 - Unrestricted Upload of File with Dangerous Type View on NVD

High

CVE-2021-34994

CVSS: 8.8 CWE: CWE-20 - Improper Input Validation View on NVD

Critical

CVE-2021-34993

This vulnerability allows remote attackers to bypass authentication on affected installations of Commvault CommCell 11.22.22. Authentication is not required to exploit this vulnerability. The specifi…

CVSS: 9.8 CWE: CWE-287 - Improper Authentication View on NVD

2020-10-29

High

CVE-2020-25780

In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, Directory Traversal can occur such that an attempt to view a log file can instea…

CVSS: 7.5 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') View on NVD

2018-01-19

Critical

CVE-2017-18044

A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvault service does not properly validate th…

CVSS: 9.8 CWE: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') View on NVD

2017-12-16

Critical

CVE-2017-3195

Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack-based buffer overflow vulnerability that could lead to arbitrary code executio…

CVSS: 9.8 CWE: CWE-121 - Stack-based Buffer Overflow View on NVD

2015-11-04

Critical

CVE-2015-7253

The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized data in a cookie.

CVSS: 10.0 CWE: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') View on NVD