Is CVE-2025-34028 actively exploited?

Yes. KEV Intelligence tracks CVE-2025-34028 as a known exploited vulnerability. Confidence is confirmed.

What exploitation activity has KEV Intelligence observed?

KEV Intelligence has not yet recorded sensor-observed exploitation attempts for CVE-2025-34028. Our sensors continue to monitor for activity targeting this CVE.

Which versions are affected?

CVE-2025-34028 affects Commvault Command Center Innovation Release. Reported affected version: 11.38.0 to <= 11.38.25.

Yes. CVE-2025-34028 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. KEV Intelligence attested it 393 days ahead of CISA.

CVE-2025-34028 Exploited in the Wild — Command Center Innovation Release

Q: How should organizations remediate it?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Q: Is it in CISA KEV?

Yes. CVE-2025-34028 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. KEV Intelligence attested it 393 days ahead of CISA.

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2025-34028 is an unauthenticated vulnerability affecting Commvault Command Center Innovation Release. The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that...

Is it exploited?

Yes. KEV Intelligence tracks this CVE as a known exploited vulnerability. Confidence is confirmed.

Who is affected?

Commvault / Command Center Innovation Release 11.38.0 to <= 11.38.25.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

Command Center Innovation Release Path Traversal

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when expanded by the target server, are vulnerable to path traversal vulnerability that can result in Remote Code Execution via malicious JSP.

This issue affects Command Center Innovation Release: 11.38.0 to 11.38.20. The vulnerability is fixed in 11.38.20 with SP38-CU20-433 and SP38-CU20-436 and also fixed in 11.38.25 with SP38-CU25-434 and SP38-CU25-438.

Vendor Product Affected Status

Commvault Command Center Innovation Release Through 11.38.25 Affected

View vendor advisory

Published: 22 Apr 2025
Exploitation Reported: 02 May 2025
Attack vector: Remote
Complexity: Low
Privileges: None
User interaction: None

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2025-34028
Vendor Advisory — documentation.commvault.com documentation.commvault.com · Vendor Advisory https://documentation.commvault.com/securityadvisories/CV_2025_04_1.html
Third-Party Advisory — vulncheck.com vulncheck.com · Third-Party Advisory https://www.vulncheck.com/advisories/commvault-command-center-innovat...
Exploit — labs.watchtowr.com labs.watchtowr.com · Exploit https://labs.watchtowr.com/fire-in-the-hole-were-breaching-the-vault-...
GitHub — watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-CVE-2025-34028 github.com · Exploit https://github.com/watchtowrlabs/watchTowr-vs-Commvault-PreAuth-RCE-C...

Exploitation evidence

Why KEV Intelligence marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

CISA

Recorded 02 May 2025

Independent exploitation attestation added to the KEV Intelligence record.

Proof of concept available

GitHub

Recorded 17 Apr 2025

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the KEV Intelligence Pro API.

Learn about Pro API access

Source	Added
All CISA Advisories First	2025-05-05 08:35 UTC
CISA	2026-06-02 14:08 UTC
The Shadowserver	2026-07-06 00:00 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets: 0
User-Agents: 0

Raw values available in Pro and Enterprise.

Scanner coverage

Nuclei template detected 16 May 2025.

View Nuclei template

Virtual patch status

No KEV Intelligence virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

Scanner Artifacts

Scanner and exploit-framework references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34028.yaml	16 May 2025

Risk and context

Severity, weaknesses, and research context

CVSS v4.0

9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H

EPSS

97.7%

Weaknesses

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 Missing Authentication for Critical Function CWE-306

Recent mention · TheHackerNews

Commvault CVE-2025-34028 Added to CISA KEV After Active Exploitation Confirmed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a maximum-severity security flaw impacting Commvault Command Center to its Known Exploited Vulnerabilities (KEV) catalog, a little over a week after it was publicly disclosed. The vulnerability in...

Read full advisory

All CVSS Scores

CVSS v4.0 9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H

CVSS v3.1 10.0 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

All Mentions

Recent mention · TheHackerNews

Commvault CVE-2025-34028 Added to CISA KEV After Active Exploitation Confirmed

TheHackerNews · 05 May 2025

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a maximum-severity security flaw impacting Commvault Command Center to its Known Exploited Vulnerabilities (KEV) catalog, a little over a week after it was publicly disclosed. The vulnerability in question is CVE-2025-34028 (CVSS score: 10.0), a path traversal bug that affects 11.38 Innovation Release, from versions

Recent mention · All CISA Advisories

CISA Adds Two Known Exploited Vulnerabilities to Catalog

All CISA Advisories · 02 May 2025

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-34028 Commvault Command Center Path Traversal Vulnerability CVE-2024-58136 Yiiframework Yii Improper Protection of Alternate Path Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a...

Recent mention · watchTowr

Fire In The Hole, We’re Breaching The Vault - Commvault Remote Code Execution (CVE-2025-34028)

watchTowr · 24 Apr 2025

As we pack our bags and prepare for the adult-er version of BlackHat (that apparently doesn’t require us to print out stolen mailspoolz to hand to people at their talks), we want to tell you about a recent adventure - a heist, if you will.No heist story

Recent mention · TheHackerNews

Critical Commvault Command Center Flaw Enables Attackers to Execute Code Remotely

TheHackerNews · 24 Apr 2025

A critical security flaw has been disclosed in the Commvault Command Center that could allow arbitrary code execution on affected installations. The vulnerability, tracked as CVE-2025-34028, carries a CVSS score of 9.0 out of a maximum of 10.0. "A critical security vulnerability has been identified in the Command Center installation, allowing remote attackers to execute arbitrary code without

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Commvault - SSRF via /commandcenter/deployWebpackage.do

nuclei · Created Unknown

Timeline

From disclosure to observed exploitation

06 Jul 2026
KEV confirmed by The Shadowserver

Exploitation attested by an external source
12 Jun 2026
Public PoC available

Public proof-of-concept code published
02 Jun 2026
Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
16 May 2025
Nuclei template available

Scanner coverage available
05 May 2025
Added to KEV Intelligence KEV Feed

High-confidence, third-party attested exploitation
22 Apr 2025
CVE published

Vulnerability disclosed publicly
15 Apr 2025
CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro pricing Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2025-34028

Free JSON includes basic KEV fields

{
  "cve_id": "CVE-2025-34028",
  "confidence": "Confirmed",
  "cvss_score": 9.3,
  "cvss_estimated": false,
  "epss_score": 0.97657,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}

CVE-2025-34028

What security teams need to know first

Command Center Innovation Release Path Traversal

Tags

CVE References

Why KEV Intelligence marks this CVE as exploited

Exploited in the wild

Proof of concept available

Known exploited vulnerability sources

Operational artifacts and observed signals

Observed signals

Scanner coverage

Virtual patch status

Scanner Artifacts

Severity, weaknesses, and research context

Weaknesses

Commvault CVE-2025-34028 Added to CISA KEV After Active Exploitation Confirmed

All CVSS Scores

All Mentions

Potential Proof of Concepts

From disclosure to observed exploitation

KEV confirmed by The Shadowserver

Public PoC available

Added to CISA KEV

Nuclei template available

Added to KEV Intelligence KEV Feed

CVE published

CVE ID reserved

Automate this intelligence

Get alerts on high-impact exploitation