Multiple Vulnerabilities in Commvault Backup & Recovery Could Allow for Remote Code Execution

Multiple high-severity vulnerabilities in Commvault Backup & Recovery (CVE-2025-57788–57791) allow unauthenticated API access, default-credential privilege escalation during initial setup, path traversal to access the file system, and command-line argument injection; the report describes two RCE chains (one dependent on an unchanged built-in admin password, and one that can deploy a webshell on any unpatched instance).