Commvault fixes critical Command Center issue after flaw finder alert

An update that fixed a critical flaw in data protection biz Commvault's Command Center was initially not available to a significant user subset – those testing out a free trial version of the product. That is, until a security researcher pointed out the problem. Commvault offers a suite of tools for data security. Command Center is a dashboard bundled with several other tools that give customers a simple visual view of the data they're trying to protect. Last week, the Cybersecurity and Infrastructure Security Agency warned that the issue, CVE-2025-34028, was under active exploitation, giving it the highest possible CVSS 10 severity ranking. The flaw earned its high ranking because it was a path traversal bug that allowed an attacker to get remote code execution privileges on the system by sending ZIP files that contained malicious .jsp files. A security team at watchTowr Labs spotted the flaw last month, and CISA warned Windows and Linux users to update to the latest version of Commvault Command Center, which was supposed to fix the issue. But according to respected former CERT security analyst Will Dorman, the updates didn't work for everyone. Worse, it appeared to Dorman, who was using a free unlicensed version of Command Center, that he had the right version number to fix the flaw - meaning a fastidious updater with an eagle eye for details might think they were protected. But then he tested it. "It seems that the VM that I have is 11.38.25, which contains the fix for CVE...