The flaw affects multiple versions of Commvault’s software across Linux and Windows platforms, posing significant risks of unauthorized access, data exfiltration, and systemic breaches. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. These stealthy scripts grant persistent remote access, enabling attackers to bypass authentication, manipulate protected data, and pivot to other network resources. With Commvault software integral to global data protection infrastructures spanning financial, healthcare, and government sectors—this vulnerability demands prioritized remediation. Network segmentation and strict inbound/outbound firewall rules for Commvault’s web ports (e.g., TCP/80, TCP/443) are critical interim measures for environments requiring delayed patching. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. Commvault’s advisory explicitly warns that “Webservers can be compromised through bad actors creating and executing webshells,” highlighting the direct path to system takeover. Delaying patches risks exploitation, as webshells can evade traditional detection systems while maintaining covert access. Additionally, audit logs for anomalous POST requests to /webconsole/API or unexpected *.jspx file creations can help detect exploit attempts. Although the exploit specifics remain undisclosed, third-party researchers speculate it involves improper sanitization of user-supplied paths in file upload handlers. Cybercriminals are advancing beyond rudimentary phishing attempts, adopting sophisticated social engineering strategies that build relationships with targets before delivering malicious payloads. As cybercriminals increasingly target backup systems, securing Commvault environments becomes paramount to ensuring organizational resilience. She is covering various cyber security incidents happening in the Cyber Space. Patched releases were initially rolled out on March 4, 2025, with additional fixes on March 7 to strengthen webserver security. Webshells typically written in ASP, PHP, or JSP are often deployed through compromised file upload mechanisms or injection attacks. Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 10 Mar 2025 07:10:07 +0000