Commvault Web Server / Command Center Vulnerabilities & Security Advisories
4 advisories tracked · Commvault Cloud Security Advisories · 2 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Commvault advisory that VulniPulse classified as Web Server / Command Center, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 1 critical, 1 high, 2 medium.
Android app · Google Play
Monitor Commvault CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Commvault Cloud Security Advisories
Polled by parsing the official Commvault security-advisories index (documentation.commvault.com), which lists every CV_YYYY_MM_N advisory with its CVEs and dates. Advisory pages are fetched for new items to extract severity, impacted products and the Feature Release / Maintenance Release fix table.
Latest Commvault Web Server / Command Center advisories
Critical [CVE-2025-34028] Vulnerability in Commvault Command Center Installation
Vulnerability in Commvault Command Center Installation
High [CVE-2025-3928] Critical Webserver Vulnerability
CVE.Org link: CVE-2025-3928 Save as PDF A vulnerability has been identified and remediated in all supported versions of the Commvault software. Webservers can be compromised through bad actors creating and executing webshells. Exploiting this vulnerability requires a bad actor to have authenticated user credentials within the Commvault Software environment. Unauthenticated access is not exploitable. For software customers, this means your environment must be: (i) accessible via the internet, (ii) compromised through an unrelated avenue, and (iii) accessed leveraging legitimate user credentials. Affected product named by the advisory: Web Server.
Medium SQL Injection Vulnerability
Save as PDF A security vulnerability has been identified in the CommServe and Web Server installation that allows a remote SQL Injection attack without authentication. Other installations in the same system are not compromised by this vulnerability.CVSS Score: 5.5
Medium Authentication Bypass Vulnerabilities on CVWebService Endpoint
Authentication Bypass Vulnerabilities on CVWebService Endpoint