Back to Database
Status published
Medium
CVE-2025-34136
Commvault CommServe Web Server Unauthenticated SQL Injection
Vulnerability Description
An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, unauthenticated attacker to perform SQL Injection. The vulnerability impacts systems where the CommServe and Web Server roles are installed. Other Commvault components deployed in the same environment are not affected.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-34136
Credits & Attribution
No credits recorded in the NVD database.
References
More from Commvault
View All →CVE-2025-57791
Argument Injection Vulnerability in CommServe
Medium
6.9
CVE-2025-57790
Path Traversal Vulnerability
High
8.7
CVE-2025-57789
Vulnerability in Initial Administrator Login Process
Medium
5.3
CVE-2025-57788
Unauthorized API Access Risk
Medium
6.9
CVE-2025-3928
Commvault Web Server unspecified vulnerability
High
8.7
Affected Vendor
Commvault
View all reports →Affected Software
Commvault
Vulnerable Versions:
11.32.0, 11.36.0, 11.38.0
Timeline
Official Publish:
July 25th, 2025
Last Modified:
November 19th, 2025
Added to House:
July 22nd, 2026