Vulnerability · Published Jul 25, 2025 · Assigned by VulnCheck

CVE-2025-34136Commvault CommServe Web Server Unauthenticated SQL Injection

Medium 6.9

In plain English

A medium-severity SQL injection in Commvault from Commvault. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 55.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed. Other Commvault components deployed in the same environment are not affected.

Affected products (as reported)

Vendor	Product	Versions
Commvault	Commvault	11.32.0 – through 11.32.9311.36.0 – through 11.36.5111.38.0 – through 11.38.19

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

https://documentation.commvault.com/securityadvisories/CV_2025_04_2.html vendor-advisory, patch
https://www.vulncheck.com/advisories/commvault-commserve-web-server-unauth-sqli third-party-advisory