The discovery of CVE-2025-34028 in Commvault Command Center, a critical vulnerability with a CVSS score of 9.0 that enables unauthenticated remote code execution, has exposed a troubling reality in modern cybersecurity. The very systems designed to protect enterprise data during disasters have become prime targets for attackers seeking complete organizational compromise.
The Threat Landscape
Backup and data management platforms have evolved into high-value targets for several reasons. These systems hold the keys to organizational recovery after ransomware attacks, natural disasters, or system failures. When an attacker gains control of backup infrastructure, they effectively hold the organization hostage. Worse still, backup systems often contain credentials for critical servers, databases, and storage arrays across the entire enterprise network.
The Commvault vulnerability, discovered by watchTowr Labs researcher Sonny Macdonald on April 7, 2025, exploits a Server-Side Request Forgery weakness in the deployWebpackage.do endpoint of Commvault Command Center. The attack begins with a pre-authenticated SSRF vector due to insufficient validation of external servers the system communicates with. From there, attackers can chain the SSRF with a malicious ZIP archive containing a crafted JSP file, tricking the server into fetching and executing attacker-controlled code.
This pattern is not isolated. Throughout 2024 and into 2025, backup systems from multiple vendors have disclosed critical vulnerabilities, including remote code execution flaws, authentication bypasses, and privilege escalation vectors. The common thread is that these platforms were designed for reliability and functionality, not for exposure to hostile internet environments.
Core Principles
Securing backup infrastructure requires a fundamentally different approach than traditional endpoint or network security. The first principle is network isolation. Backup systems should never be directly accessible from the internet. They should reside in dedicated network segments with strict firewall rules limiting access to authorized backup agents and administrative workstations only.
The second principle is the principle of least privilege for backup credentials. Backup systems typically require high-level access to servers and databases to perform their function. These credentials should be rotated frequently, stored in hardware security modules where possible, and access should be time-limited and auditable.
The third principle is defense in depth for the backup management interface itself. Even if the primary application has a vulnerability, additional layers such as web application firewalls, intrusion detection systems monitoring the backup network segment, and multi-factor authentication for all administrative access can prevent exploitation.
Tooling and Setup
Organizations should implement a comprehensive security monitoring stack specifically for backup infrastructure. This includes deploying endpoint detection and response agents on backup servers, configuring log aggregation to send backup system events to a centralized SIEM, and establishing automated alerting for anomalous activities such as unexpected file uploads, configuration changes outside maintenance windows, or authentication attempts from unusual locations.
Patch management for backup systems deserves its own dedicated workflow. Unlike general server patching which might follow monthly or quarterly cycles, backup platform security updates should be treated as critical and applied within 48 hours of release. The Commvault patch for CVE-2025-34028 was available on April 10, 2025, yet many organizations remained unpatched when public disclosure occurred on April 17.
For organizations running Commvault Innovation Release versions 11.38.0 through 11.38.19 on Linux or Windows, upgrading to version 11.38.20 or 11.38.25 is mandatory. watchTowr Labs has released a Detection Artefact Generator specifically to help administrators identify systems exposed to CVE-2025-34028.
Ongoing Vigilance
Beyond immediate patching, organizations should conduct regular penetration testing of their backup infrastructure. This includes testing both the management interface and the backup agents deployed across the network. Many organizations test their web applications and network perimeter but neglect the backup stack, creating blind spots that attackers are increasingly exploiting.
Incident response plans should include specific procedures for backup system compromise. If attackers control your backups, standard recovery procedures become unreliable. Maintaining immutable backup copies in air-gapped or write-once storage ensures that even a complete compromise of the primary backup platform cannot destroy all recovery options.
Final Takeaway
The security of your backup infrastructure is directly proportional to your organization’s resilience against catastrophic attacks. As ransomware operators and nation-state attackers increasingly target data protection systems, the old approach of securing production systems while leaving backups in a trusted zone is no longer viable. Every component in your backup stack, from the management console to the storage arrays, must be hardened, monitored, and maintained with the same rigor you apply to your most critical production systems.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any investment decisions.
the SSRF in deployWebpackage.do bypassed auth entirely. no credentials needed, just send a crafted request to the endpoint and you own the box
The gap between crypto and TradFi is narrowing fast
backup infrastructure getting hit is the same pattern as domain controllers. admins always assume internal systems are safe and skip hardening
Tomasz K. backup infra is the crown jewel because it has credentials for everything. attackers dont need to enumerate the network when the backup system hands them the keys
Blaz backup infra IS the crown jewels is exactly right. lockbit and blackcat have been targeting veeam and commvault for 2 years now. this CVE just gave them a new front door
ransomware_watch Lockbit and Blackcat targeting backup infrastructure for 2 years and Commvault still shipped a 9.0 CVSS unauthenticated RCE. threat modeling at enterprise vendors is broken
watchTowr finding the SSRF in deployWebpackage.do means Commvault shipped a web endpoint that accepted arbitrary URLs without authentication. how does that pass any security review
This is exactly the kind of development the space needs
Mass adoption is happening incrementally — people just don’t notice
watchTowr finding this in April 2025 and Commvault taking weeks to patch. how many threat actors reverse engineered the fix before it shipped
Filip M. watchTowr probably found it weeks before the patch dropped. zero-days in backup infrastructure are sold for six figures on dark markets
Sonja K. zero-days in backup infrastructure sell for six figures because one CVE gives you the entire network. watchTowr probably wasnt the only team that found this
CVSS 9.0 unauthenticated RCE on a backup platform that holds recovery keys for the entire org. this is the nightmare scenario every CISO has been warning about since ransomware went mainstream
Filip M. weeks to patch is the industry standard. commvault is not uniquely slow, every enterprise vendor sits on criticals to batch them into quarterly cycles
9.0 CVSS unauthenticated RCE on a backup platform. the backup system holds domain admin creds for every server in the company. one CVE and you own the entire org
CVSS 9.0 unauthenticated RCE on the system that holds every server credential. backup admins have been the softest target for years and nothing changes
ransomware groups have been explicitly targeting backup infrastructure for 3 years. if you can destroy the backups first the company has no choice but to pay. Commvault should have known better
SSRF in deployWebpackage.do leading to RCE is a classic chain. pre-auth SSRF plus internal services with no auth equals game over
ssrf_hunter_ pre-auth SSRF into RCE is the most predictable attack chain in enterprise software. how Commvault shipped deployWebpackage.do without auth validation is beyond me
backup systems containing credentials for databases and storage arrays across the network. compromise one backup server and you basically own the entire infrastructure. the blast radius is insane
ir_team_rat_ pre-auth SSRF to RCE is literally in every penetration testing course as the classic chain. Commvault shipping deployWebpackage.do without validation is negligence not a bug
CVE with a 9.0 CVSS on a backup platform that holds credentials for every server in the org. attackers dont even need to find the crown jewels, the backup system IS the crown jewels
null_pointer 9.0 CVSS unauthenticated RCE on a system that stores every credential in the org. this is the exact scenario ransomware operators dream about
cvss_watcher_ the SSRF in deployWebpackage.do means attackers dont even need credentials. unauthenticated RCE on a backup server is basically a god mode switch