CVE-2025-34136: Commvault

Medium severity, CVSS 6.9. EPSS: 0.5% chance of exploitation in the next 30 days.

An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed. Other Commvault components deployed in the same environment are not affected.

Affected products

• Commvault Commvault: from 11.32.0, up to and including 11.32.93; from 11.36.0, up to and including 11.36.51; from 11.38.0, up to and including 11.38.19

Published 2025-07-25. Last modified 2026-06-17.