Medium severity · published Jul 25, 2025
CVE-2025-34136
Commvault CommServe Web Server Unauthenticated SQL Injection
6.9
CVSS
0.5%
EPSS
No
On KEV
Description
An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed. Other Commvault components deployed in the same environment are not affected.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Commvault · Commvault
11.32.0 through 11.32.93; 11.36.0 through 11.36.51; 11.38.0 through 11.38.19 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-34136
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-34136
documentation.commvault.com
https://documentation.commvault.com/securityadvisories/CV_2025_04_2.html
www.vulncheck.com
https://www.vulncheck.com/advisories/commvault-commserve-web-server-unauth-sqli
More from Commvault
10.0
CVE-2025-34028
Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal
8.8
CVE-2025-3928
Commvault Web Server unspecified vulnerability
9.8
CVE-2026-77098
Private Metrics Server SQL Injection
9.8
CVE-2026-77092
Content Extractor Privilege Escalation
9.8
CVE-2026-77089
Command Center API Authentication Bypass