CVE-2025-57788VulnerabilityPublished 20 Aug 2025Updated 11 Sep 2025

CVE-2025-57788: Commvault CommCell · Use of Hard-coded Password

Affects Commvault CommCellSource CVE Database V5

Not known to be exploited · public exploit available (Metasploit) · CVSS 6.9 Medium.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 4.0 base score

6.9Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 7.7% chance of exploitation in 30 days – higher than 94% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable system confidentiality: Low
Vulnerable system integrity: Low
Vulnerable system availability: None
Subsequent system confidentiality: None
Subsequent system integrity: None
Subsequent system availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Attack Requirements: None: The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without interaction from any human user, other than the attacker.
Vulnerable system confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the Vulnerable System.
Vulnerable system integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact to the Vulnerable System.
Vulnerable system availability: None: There is no impact to availability within the Vulnerable System.
Subsequent system confidentiality: None: There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
Subsequent system integrity: None: There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
Subsequent system availability: None: There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.

Definitions: FIRST CVSS v4.0 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 20 Aug 2025
Detectable: evidence found.
nuclei template: Commvault Unauthenticated Password Disclosure (WT-2025-0047)
Weaponised: evidence found.
1 Metasploit module
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Commvault CommCell	Affected =11.32.0 =11.36.0	Fixed in–

AI-suggested

To mitigate CVE-2025-57788 effectively, European organizations should: 1) Immediately audit all CommCell instances to identify affected versions (11.32.0 and 11.36.0) and prioritize their upgrade once patches become available. 2) Implement network segmentation and firewall rules to restrict access to CommCell management interfaces and APIs strictly to trusted administrative networks and personnel. 3) Employ multi-factor authentication (MFA) for all administrative access where possible, even if the vulnerability bypasses authentication, to add an additional security layer. 4) Monitor CommCell API usage logs for anomalous or unauthorized activity indicative of exploitation attempts. 5) Temporarily disable or restrict API access if feasible until a patch is released. 6) Engage with Commvault support to obtain guidance on workarounds or interim fixes. 7) Incorporate vulnerability scanning and penetration testing focused on backup infrastructure to detect similar issues proactively. These steps go beyond generic advice by focusing on access control hardening, monitoring, and operational controls tailored to the backup environment.

Description

A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.

Impact

For European organizations, the impact of CVE-2025-57788 can be substantial, especially for enterprises relying on Commvault CommCell for backup and data management. Unauthorized API access could lead to exposure or manipulation of backup data, undermining data integrity and confidentiality. This could result in data breaches, compliance violations (e.g., GDPR), and disruption of backup and recovery operations. Attackers might also leverage this access to pivot within the network, escalating privileges or deploying ransomware. Given that backups are critical for business continuity, any compromise could severely affect operational resilience. The medium severity rating suggests that while the vulnerability is exploitable without authentication, the damage scope might be limited by RBAC controls; however, these controls are not foolproof. European organizations with stringent data protection requirements and those in regulated sectors (finance, healthcare, government) face heightened risks due to potential data exposure and regulatory penalties.

Metasploit modules

Commvault Command-Line Argument Injection to Traversal Remote Code Executionexploit · Excellent (opens in a new tab)

Nuclei detection templates

Commvault Unauthenticated Password Disclosure (WT-2025-0047)medium (opens in a new tab)

Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.

CWE-259Use of Hard-coded Password (opens in a new tab)
Variant weaknessLikelihood of exploit: HighOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
Architecture and Design
For outbound authentication: store passwords outside of the code in a strongly-protected, encrypted configuration file or database that is protected from access by all outsiders, including other local users on the same system. Properly protect the key (CWE-320).
Architecture and Design
For inbound authentication: Rather than hard-code a default username and password for first time logins, utilize a "first login" mode that requires the user to enter a unique strong password.
Architecture and Design
Perform access control checks and limit which entities can access the feature that requires the hard-coded password. For example, a feature might only be enabled through the system console instead of through a network connection.
OWASP Cheat Sheets
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V2.3.1 (opens in a new tab)
V2.6.2 (opens in a new tab)
V2.8.5 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 17 Sep 2025, 00:48 UTC

Public exploits and detection1 Metasploit module, a Nuclei detection template

WeaknessesCWE-259

Technical details

References

Community reviews

Related threats