CVE-2025-57789

35

FAUCET Score

CVE-2025-57789 is a medium-severity vulnerability affecting Commvault products, allowing remote attackers to gain administrative control during the brief setup phase before the first administrator login. The attack requires low privileges and no user interaction, but only impacts confidentiality and integrity with low impact. While not actively exploited (no KEV), Nuclei templates exist, and it has garnered significant community discussion, indicating potential for future exploitation.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 11.36.60CPE matchmatch criteria	cpe:2.3:a:commvault:commvault::::::::
		>= 11.32.0, <= 11.32.101CPE match	cpe:2.3:a:commvault:commcell::::::::
		>= 11.36.0, <= 11.36.59CPE match	cpe:2.3:a:commvault:commcell::::::::

CVSS Data

CVSS version used by this source: 4.0

5.3MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

LOW

User Interaction

NONE

VS Confidentiality

LOW

VS Integrity

LOW

VS Availability

NONE

SS Confidentiality

NONE

SS Integrity

NONE

SS Availability

NONE

Exploit Maturity

NOT_DEFINED

CvssVersion

4.0

Exploit Intelligence

EPSS Score

1.15%

Probability of exploitation in next 30 days

EPSS Percentile

63.4%

Percentile rank of EPSS score among Peer Group

As of 2026-07-25

Model: v2026.06.15

Nuclei: CVE-2025-57789 · Aug 20, 2025

This CVE's current EPSS score of 0.0115 is in the 77th percentile among its peer group of 21,951 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (8)

barracudapatch availablevia llm_extracted

boschpatch availablevia llm_extracted

clamavpatch availablevia llm_extracted

consulpatch availablevia llm_extracted

freshrsspatch availablevia llm_extracted

qdrantpatch availablevia llm_extracted

symantecpatch availablevia llm_extracted

verbbpatch availablevia llm_extracted

Vendor Advisories (8)

barracudallm-barracuda-1ab49e30ec84d378

Vulnerability in Initial Administrator Login Process

symantecllm-symantec-a2486d4d863fa857

Vulnerability in Initial Administrator Login Process

verbbllm-verbb-21d0cc2f31a4620d

Vulnerability in Initial Administrator Login Process

consulllm-consul-6cba03820484c35f

Vulnerability in Initial Administrator Login Process

clamavllm-clamav-a0c6538f9e86f7ac

Vulnerability in Initial Administrator Login Process

boschllm-bosch-11bfe897ea6c3b71

Vulnerability in Initial Administrator Login Process

freshrssllm-freshrss-fce112fa31b4d00d

Vulnerability in Initial Administrator Login Process

qdrantllm-qdrant-eb8f8660b8f478c6

Vulnerability in Initial Administrator Login Process

References

documentation.commvault.com / securityadvisories/CV_2025_08_4.html

Vendor Advisory