TI-2025-35671 Aliases CVE-2025-57788 GHSA-w78r-f8w4-qxcq

Unauthorized API Access Risk

MEDIUM 47CWE-259Published 2025-08-20 · Updated 2025-09-11

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-259.

Summary

A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.07762 94th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Commvault	CommCell	11.32.0 – 11.32.101; 11.36.0 – 11.36.59	—	No fix listed	CNA

CommCell VendorCommvault Affected 11.32.0 – 11.32.101; 11.36.0 – 11.36.59 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:commvault:commvault::::::::	before 11.36.60	Vulnerable	Commvault

cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:* Versions before 11.36.60 Vulnerable ·Commvault

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-57788
2026-10-03 Alias added: GHSA-w78r-f8w4-qxcq
2026-10-11 EPSS moved to the 90th–95th percentile

References

Exploit 1

https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/#wt-2025-0047hardcoded-credentials

Advisory 1

https://documentation.commvault.com/securityadvisories/CV_2025_08_3.html

TI-2025-24197 Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal KEVCVSS 4.0CRITICAL 9.3
TI-2025-03473 Commvault Web Server unspecified vulnerability KEVCVSS 4.0HIGH 8.7
TI-2017-13252 A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault… CVSS 3.0CRITICAL 9.8
TI-2025-35673 Path traversal in Commvault CommCell CVSS 4.0HIGH 8.7
TI-2025-35674 Argument Injection Vulnerability in CommServe CVSS 4.0MEDIUM 6.9
TI-2026-53842 Command Center API Authentication Bypass CVSS 4.0CRITICAL 9.3

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences