Is CVE-2025-34028 (Commvault Command Center Path Traversal) being exploited in the wild?

Yes. CISA added CVE-2025-34028 to its Known Exploited Vulnerabilities catalogue on 2 May 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code. Any organisation running the affected product should treat remediation as urgent.

What “exploited in the wild” means for this CVE

CISA’s KEV listing is the practical signal that matters most for this question. For CVE-2025-34028, the issue is not just that Commvault Command Center has a path traversal flaw, but that the vulnerability has been treated by CISA as an actively exploited weakness, which should move it from ordinary patch planning into urgent response mode.

That changes the operational decision. When a flaw is in KEV, the question is no longer whether exploitation is possible in theory. The relevant judgment is whether the product is present, reachable, and already exposed long enough to have been abused before remediation.

What teams should check first

Start with exposure confirmation. Identify every deployment of Commvault Command Center, including test, backup, and disaster recovery environments, because product ownership is often split and shadow instances are easy to miss. Then verify whether the instance is internet-facing, whether it is behind compensating controls, and whether any adjacent systems could have been reached through it.

Use the vendor advisory and CISA KEV catalogue for version-specific remediation details rather than relying on second-hand summaries. The most important first-pass question is simple: can this instance still accept traffic that could reach the vulnerable path handling logic?

For broader vulnerability triage and emergency response workflow, follow the Zero-Day and Exploited Vulnerabilities Guide and align it with your asset inventory and remediation queue. If you need a broader prioritisation baseline, the Vulnerability Management Guide is the better companion for deciding what to patch first and how to verify closure.

What to do when patching cannot happen immediately

If remediation must wait, treat the environment as under active threat exposure, not merely vulnerable. Reduce reachability, restrict administrative access, segment the product from less trusted networks, and watch for unusual requests that try to traverse directories or reach application files outside the intended path structure. Temporary mitigation is only acceptable if it meaningfully lowers the chance of exploitation before the fix lands.

Do not stop at perimeter blocking. A remote, unauthenticated flaw can still be reachable from partner networks, management paths, or misconfigured reverse proxies. If the product cannot be patched quickly, the compensating control must be strong enough to justify the delay, and that justification should be time-bound.

Because this is a path traversal condition with arbitrary code execution potential, the relevant defensive work is not just perimeter filtering. Review the product’s exposure in the context of host hardening, service permissions, and any accounts or credentials the application can reach if the flaw is triggered.

Risk and Threat Considerations

Actively exploited, unauthenticated remote code execution flaws are high-value intrusion paths because they can be used before defenders finish normal patch cycles. Path traversal often matters because it can bypass intended file access boundaries, reach sensitive application components, and become a bridge into broader host compromise.

Failure mechanism: An attacker uses crafted path input to escape the intended directory context, reaches protected resources or execution-relevant files, and then leverages the resulting access to run code or stage follow-on activity.

Impact: The exposed server can become an initial foothold for data theft, persistence, lateral movement, or service disruption, especially if the application runs with elevated privileges or has access to backup-related secrets and management functions.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability Identification	Prioritising an actively exploited CVE depends on knowing where the vulnerable product is deployed.
	PR.PS-03 — System Configuration Management	A path traversal RCE requires rapid configuration change, isolation, or patching of the affected system.
	DE.CM-01 — Networks and Network Services Monitored	KEV-listed exploitation calls for monitoring traversal attempts and suspicious post-exploitation activity.
Recommendation — Identify all Commvault Command Center instances and rank them by exposure before remediation. Harden or isolate the affected deployment until the vulnerability is removed. Monitor for directory traversal patterns and unusual command execution on the host.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	An exploited CVE needs continuous identification of exposed instances and remediation status.
	SI-2 — Flaw Remediation	The core response to an actively exploited product flaw is prompt remediation or mitigation.
	SI-4 — System Monitoring	Exploitation checks depend on detecting suspicious access, traversal, or code execution.
Recommendation — Scan for every vulnerable deployment and track remediation to closure. Apply the vendor fix or approved mitigation immediately on affected systems. Review logs and alerts for traversal requests and follow-on execution attempts.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes timely identification and remediation of the vulnerable asset essential.
	CIS-8 — Audit Log Management	Post-exploitation review depends on logs that can reveal traversal attempts and malicious actions.
Recommendation — Prioritise exposed Commvault deployments for immediate remediation and verification. Preserve and review logs for signs of exploitation and post-compromise activity.
OWASP ASVS	V15 — Secure Coding and Architecture	Path traversal is an application-layer control failure tied to unsafe path handling.
Recommendation — Review path handling and file access logic to prevent traversal-based abuse.
MITRE ATT&CK	T1006 — Direct Volume Access	The question concerns exploitation mechanics that can lead to direct system access after compromise.
Recommendation — Hunt for post-compromise access patterns and constrain attacker paths after initial foothold.

Practitioner Guidance

What to prioritise: Patch or isolate every exposed Commvault Command Center instance before spending time on lower-severity backlog items. For a KEV-listed flaw, remediation order should follow exposure, reachability, and privilege impact, not internal ticket age.

What to verify: Confirm whether the product has been internet-exposed, whether any requests or logs show directory traversal patterns, and whether the host or adjacent systems changed around the exploitation window. If patching was delayed, validate whether the system shows signs of pre-remediation compromise.

Escalation / exception: If the platform cannot be patched immediately, treat the exception as temporary and high risk, with a clear owner and expiry. If the instance stores backup data, management tokens, or privileged service credentials, escalate faster because the blast radius is usually larger than the application itself.

Practitioner takeaway: KEV status is the signal to assume real-world abuse is plausible already, so response should focus on exposure reduction, compromise checking, and rapid closure rather than debating whether the flaw is interesting enough to patch.