CVE‑2025‑34028: Commvault Command Center Path Traversal Allows Remote Code Execution
What It Is – A path‑traversal flaw in Commvault Command Center lets an unauthenticated attacker read arbitrary files and execute code on the host system.
Exploitability – The vulnerability is publicly disclosed, has a public proof‑of‑concept, and is rated high‑severity (CVSS ≈ 9.8).
Affected Products – Commvault Command Center (all versions prior to the vendor‑released patch).
Why It Matters for Trust & Control Assurance
- Continuous monitoring of third‑party software updates is a core control for demonstrating due‑diligence in vendor risk programs.
- Evidence of timely patching feeds directly into audit‑ready artifacts for control objectives around supply‑chain security.
- Enterprise buyers increasingly require verifiable proof that critical backup and recovery tools are free from known exploitable flaws.
Recommended Actions
- Inventory all Commvault Command Center deployments and record current version.
- Apply the vendor‑issued patch immediately; if patching is delayed, isolate the affected system.
- Update your third‑party risk register with remediation evidence (patch tickets, scan results).
- Incorporate automated vulnerability scanning of backup infrastructure into your continuous control monitoring program.
Source: CISA KEV – CVE‑2025‑34028