CVE-2021-34997: high-severity vulnerability in Commvault CommCell
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 4.4%
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the AppStudioUploadHandler class. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-13894.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Commvault · CommCellRelated CVEs — Commvault CommCell
In the same product, most dangerous first.
CVE-2021-34996HIGHCVE-2021-34996EPSS 82.3%CVE-2021-34995HIGHCVE-2021-34995EPSS 68.9%CVE-2025-57790HIGHPath Traversal VulnerabilityEPSS 43.6%CVE-2025-57791MEDIUMArgument Injection Vulnerability in CommServeEPSS 38.8%CVE-2025-57788MEDIUMUnauthorized API Access RiskEPSS 7.8%CVE-2021-34994HIGHCVE-2021-34994EPSS 6.0%