During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Commvault
  • Commcell
  • Commvault

Configuration 1 [-]

cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://documentation.commvault.com/securityadvisories/CV_2025_08_4.html cve-icon cve-icon
History

Thu, 26 Feb 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 10 Sep 2025 16:00:00 +0000

Type Values Removed Values Added
Description An issue was discovered in Commvault before 11.36.60. During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured. During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.

Thu, 21 Aug 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Commvault commvault
CPEs cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*
Vendors & Products Commvault commvault
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Thu, 21 Aug 2025 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Commvault
Commvault commcell
Vendors & Products Commvault
Commvault commcell

Wed, 20 Aug 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 20 Aug 2025 03:45:00 +0000

Type Values Removed Values Added
Description An issue was discovered in Commvault before 11.36.60. During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This is limited to the setup phase, before any jobs have been configured.
Title Vulnerability in Initial Administrator Login Process
Weaknesses CWE-257
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2025-08-20T03:22:08.764Z

Updated: 2026-02-26T17:48:25.835Z

Reserved: 2025-08-19T18:25:57.338Z

Link: CVE-2025-57789

cve-icon Vulnrichment

Updated: 2025-08-20T13:31:13.038Z

cve-icon NVD

Status : Modified

Published: 2025-08-20T04:16:03.847

Modified: 2025-09-10T16:15:40.353

Link: CVE-2025-57789

cve-icon Redhat

No data.