CVE-2025-57791

CVE-2025-57791 is an argument injection flaw (CWE-88) in Commvault's data-protection suite in which insufficient input validation allows remote attackers to inject or manipulate command-line arguments passed to internal components. It is triggered over the network without prior authentication, user interaction, or privileges, per the CVSS 4.0 vector (AV:N/PR:N/UI:N). A successful attacker obtains a valid user session at a low-privilege role, which related advisories indicate can be chained with other pre-auth Commvault flaws to enable remote code execution. Any organization running affected Commvault software is exposed, particularly deployments whose Commvault web interfaces are reachable from the internet. No public proof-of-concept is known and the flaw is not yet in CISA's KEV, but EPSS places it in the 98th percentile (22.4% probability of exploitation within 30 days), and Commvault has already released fixes.

What to do: Apply the patches Commvault has released for this issue, using the version guidance in the vendor's security advisory since exact fixed build numbers are not included in the available data. Because the bug is pre-authentication, restrict internet-facing access to Commvault web/console interfaces to trusted networks or behind VPN, and check access logs for unexpected low-privilege session creation or command-argument anomalies. Treat it as urgent given the 98th-percentile EPSS score and the reported risk of pre-auth exploit chains reaching remote code execution.