CVE-2025-57788

CVE-2025-57788 is a medium-severity vulnerability affecting Commvault products, allowing unauthenticated attackers to execute API calls without credentials due to a flaw in a login mechanism. This vulnerability has a CVSS score of 6.5 and an extremely high EPSS score, indicating a significant likelihood of exploitation. While Role-Based Access Control (RBAC) can limit exposure, it does not fully mitigate the risk of information disclosure or integrity compromise. Exploit code, including a Metasploit module for remote code execution and Nuclei templates for password disclosure, is publicly available, and the CVE has garnered substantial community discussion, though it is not yet listed on the KEV catalog or actively exploited.