Skip to content
COOEY

FAIL › dossier

Commvault

VENDOR

· dossier confidence 60%

Commvault Systems is a public data protection vendor headquartered in Tinton Falls, NJ, offering AI-enabled cyber resiliency solutions. Its security track record is marred by a series of high-severity RCE vulnerabilities in its Web Server and Command Center, alongside multiple concurrent flaws in its Commvault Cloud platform, indicating systemic issues in patch management and secure design.

Failure events
2
Zero-days
0
RCEs
2
On KEV
2
Critical
0
Worst shame
72
PROFILE
CategoryData Protection & Cyber Resiliency VendorWhat they doCommvault Systems provides cyber resiliency solutions for enterprises to protect, secure, and recover data, applications, and identity systems. Its flagship offering, Commvault Cloud, unifies data security, cyber recovery, and identity resilience into a single AI-enabled platform.Founded1996HQTinton Falls, New Jersey, United States Websitehttps://www.commvault.com ↗
SECURITY POSTURE

Commvault's security posture is compromised by a pattern of high-severity remote code execution (RCE) vulnerabilities in its core platforms, including the Web Server and Command Center, which have been actively exploited in the wild. The company also faces recurring multiple security flaws in its Commvault Cloud platform, requiring frequent high-priority patches across multiple version lines.

Notable failures
  • CVE-2025-3928: Authenticated RCE via Web Server webshells
  • CVE-2025-34028: Unauthenticated RCE via Command Center path traversal
  • AV26-799: Multiple high-priority security flaws in Commvault Cloud
Patterns: Repeated high-severity RCE vulnerabilities in core platform components; Multiple concurrent security flaws requiring urgent patching across version lines
FAILURE HISTORY · 2
DATEEVENTSEVSUMMARY
2025-04-28 CVE-2025-3928 high A vulnerability in Commvault's Web Server allows authenticated attackers to execute webshells remotely, actively exploited in the wild.
2025-05-02 CVE-2025-34028 high Commvault Command Center's path traversal vulnerability allows unauthenticated attackers to execute arbitrary code remotely.
DOSSIER SOURCES
Open questions: Specific patch versions for AV26-799 · Total number of employees
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-08-12 04:02:25.720682+00:00