SQL Injection in Commvault
CVE-2025-34136
An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed. Other Commvault components deployed in the same environment are not affected.
Vulnerability class: SQL Injection
Published · last modified .
EPSS exploit prediction
EPSS: 0.005 (37.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 37.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Commvault — versions 11.32.0, 11.36.0, 11.38.0
Weakness classification (CWE)
References
- documentation.commvault.com/securityadvisories/CV_2025_04_2.html (vendor-advisory, patch)
- www.vulncheck.com/advisories/commvault-commserve-web-server-unauth-sqli (third-party-advisory)