Critical Commvault Path Traversal Vulnerability (CVE-2025-34028) Added to CISA KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has escalated the urgency around a critical vulnerability in Commvault Command Center, designated as CVE-2025-34028 (CVSS score: 10.0). The flaw, a path traversal issue leading to remote code execution (RCE), was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on May 2, 2025, following confirmed active exploitation¹. Federal agencies are required to patch the vulnerability by May 23, 2025, under Binding Operational Directive (BOD) 22-01².

Technical Breakdown of CVE-2025-34028

The vulnerability affects Commvault Command Center Innovation Release versions 11.38.0 through 11.38.19. Attackers exploit it by uploading malicious ZIP files to the deployWebpackage.do endpoint, which triggers server-side request forgery (SSRF) and RCE during decompression³. Unauthenticated access lowers the barrier for exploitation, making it a high-priority threat. A simplified proof-of-concept (PoC) demonstrates the attack flow:

import requests  
target = "http://target/deployWebpackage.do"  
requests.post(target, files={"file": ("exploit.zip", malicious_zip)})

This aligns with findings from WatchTowr Labs, which highlight the chaining potential of similar vulnerabilities⁴.

Broader Threat Context

CVE-2025-34028 is not isolated. A related flaw, CVE-2025-3928 (CVSS 8.7), was added to the KEV catalog on April 28, 2025, after being linked to webshell deployments in Commvault’s Azure environment⁵. Both vulnerabilities are under active exploitation by ransomware groups and nation-state actors targeting backup systems⁶.

CVE	Type	Affected Versions	Patch Deadline
CVE-2025-34028	Path Traversal → RCE	11.38.0–11.38.19	May 23, 2025
CVE-2025-3928	Webshell Deployment	Patched in 11.36.46, 11.32.89	April 28, 2025

Mitigation and Relevance

Organizations using Commvault should immediately apply patches from the vendor’s security advisory⁷. Key steps include:

Restricting access to exposed interfaces.
Monitoring for anomalous file uploads or SSRF attempts.
Validating backups to ensure they are free from compromise.

The vulnerability’s impact extends beyond federal systems, as backup solutions are often high-value targets for data exfiltration and ransomware attacks⁸.

Conclusion

CVE-2025-34028 underscores the criticality of timely patch management, especially for vulnerabilities with public exploits. CISA’s KEV catalog serves as a definitive guide for prioritizing remediation efforts. Future updates may reveal additional exploitation vectors, warranting continuous monitoring.