Commvault Default Credential Vulnerability in Initial Setup Phase Allowing Admin Access

A vulnerability exists in Commvault versions 11.32.0 through 11.32.101 and 11.36.0 through 11.36.59. During the initial setup phase, before the first administrator login, remote attackers can exploit default credentials to gain administrative control. This issue is limited to the setup phase, prior to any job configurations.

Impact

Exploitation of this vulnerability allows remote attackers to gain administrative control over the Commvault application.

Remediation

Users should install the maintenance release version 11.32.102 or 11.36.60, depending on their current version. Instructions for verifying if the update is installed are available in the Commvault security advisory.