Medium severity6.5NVD Advisory· Published Aug 20, 2025· Updated Jun 17, 2026

CVE-2025-57788

Description

A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Commvault/Commvault2 versions
cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*range: <11.36.60
- (no CPE)
Commvault/CommCellcpe-rescue
Range: 11.32.0

Patches

Vulnerability mechanics

References

labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/nvdExploitThird Party Advisory
documentation.commvault.com/securityadvisories/CV_2025_08_3.htmlnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.002
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000