CVE-2021-34995

What it actually does

CVE-2021-34995 is a remote code execution vulnerability in Commvault CommCell 11.22.22, specifically in the DownloadCenterUploadHandler class. The flaw is caused by insufficient validation of user-supplied upload data, allowing an attacker to upload arbitrary files. Although the CVSS vector lists low privileges as required, the vendor disclosure notes that the existing authentication mechanism can be bypassed, which materially lowers the practical barrier to exploitation. Successful exploitation allows code execution in the context of the Windows NETWORK SERVICE account, with potential access to Commvault application data, backup infrastructure functions, and reachable network resources available to that service context.

Why it matters to the business

Compromise of a CommCell environment can have significant operational consequences because backup and recovery platforms often hold privileged access to protected systems and sensitive backup data. An attacker who gains code execution may be able to disrupt backup operations, tamper with restore capabilities, stage additional attacks, or access sensitive data contained in backup workflows. The CVSS score of 8.8 and high EPSS score of approximately 0.69 indicate meaningful exploitation risk, especially for internet-exposed or broadly reachable CommCell services, even though this vulnerability is not currently listed in CISA KEV and is not specifically flagged as ransomware-used.

How an attack unfolds

An attacker first identifies a reachable Commvault CommCell installation running an affected 11.22.22 release. They then interact with the vulnerable DownloadCenterUploadHandler functionality and abuse weaknesses in the authentication and upload validation flow. By crafting upload requests that are accepted without sufficient validation, the attacker places an arbitrary file onto the server in a location or format that can be executed by the application or underlying platform. Once the uploaded payload is invoked, the attacker obtains code execution as NETWORK SERVICE. From there, they may enumerate the host, inspect Commvault configuration and credentials available to the service, access backup-related data, move laterally where permissions allow, or deploy persistence and additional tooling.

How to fix it

Upgrade Commvault CommCell to a vendor-supported release that contains the fix for this issue. Because no exact fixed version was provided in the input, administrators should consult Commvault security advisories and release notes for the corrected build applicable to their deployment and avoid remaining on CommCell 11.22.22. If immediate upgrade is not possible, restrict network access to CommCell management and web interfaces to trusted administrative networks, enforce strong authentication and MFA where supported, block direct internet exposure, review upload-related functionality and permissions, and apply compensating controls such as WAF rules or reverse proxy restrictions for suspicious upload requests. Also rotate credentials and review service account permissions if compromise is suspected.

How to confirm the fix worked

Confirm the installed CommCell version is no longer 11.22.22 or any other vendor-identified vulnerable build. Verify the patched server rejects unauthorized or malformed requests to DownloadCenterUploadHandler and does not allow arbitrary file types or unexpected upload destinations. Review Commvault and web server logs for upload attempts before and after patching, and confirm that only expected authenticated users can access file upload functionality. Where feasible, perform a controlled vulnerability scan or vendor-supported health check against CommCell services from both internal and external network positions to verify exposure has been removed.

Typical attack path

1. Discover a reachable Commvault CommCell service, commonly through scanning, exposed management interfaces, or known asset inventory leaks.
2. Determine that the target appears to be running an affected CommCell 11.22.22 installation or otherwise exposes the vulnerable DownloadCenterUploadHandler functionality.
3. Send crafted requests that abuse the authentication bypass condition and reach the upload handler.
4. Upload an attacker-controlled file because server-side validation does not adequately restrict file content, type, name, or destination.
5. Trigger or wait for execution of the uploaded file within the CommCell server context.
6. Gain code execution as NETWORK SERVICE.
7. Perform post-exploitation actions such as host reconnaissance, credential discovery, backup data access, lateral movement, or service disruption.

How to detect it

Investigate Commvault application logs, web server/IIS logs, Windows Event Logs, EDR telemetry, and file system artifacts for signs of suspicious upload and execution activity. Focus on requests to DownloadCenterUploadHandler, especially from unusual source IPs, unauthenticated sessions, unexpected user agents, abnormal HTTP POST activity, or uploads followed closely by process creation. Review file creation events in Commvault web, application, installation, and temporary upload directories for executable content such as .aspx, .jsp, .exe, .dll, .bat, .cmd, .ps1, or unusually named files. On Windows hosts, examine process creation events where services running as NETWORK SERVICE spawn command shells, PowerShell, scripting engines, archive utilities, network tools, or unknown binaries. Also review outbound connections from the CommCell server after suspicious uploads, authentication anomalies, new scheduled tasks, service creation events, and modifications to backup jobs or retention settings. If threat hunting finds suspicious activity, preserve affected logs and files, isolate the host where practical, and assess whether backup data, credentials, or connected systems were accessed.

• DownloadCenterUploadHandler
• POST /DownloadCenterUploadHandler
• NETWORK SERVICE
• cmd.exe /c
• powershell.exe -enc
• powershell.exe -EncodedCommand
• wscript.exe
• cscript.exe
• rundll32.exe
• regsvr32.exe
• certutil.exe -urlcache
• bitsadmin.exe
• mshta.exe
• schtasks /create
• sc.exe create
• .aspx
• .jsp
• .ashx
• .asmx
• .exe
• .dll
• .bat
• .cmd
• .ps1

What your security team should do

• Prioritize patching or upgrading affected Commvault CommCell installations, especially systems reachable from the internet or large internal networks.
• Immediately restrict access to CommCell management and web services to trusted administrative IP ranges or VPN-only paths.
• Search historical logs for suspicious access to DownloadCenterUploadHandler and unexpected file upload activity.
• Inspect CommCell web/application directories and temporary upload locations for recently created executable scripts, binaries, web shells, or anomalous files.
• Review NETWORK SERVICE process activity for unexpected child processes, outbound network connections, or command execution.
• Hunt for evidence of credential access, backup catalog access, backup job tampering, and unauthorized restore or export activity.
• Rotate credentials associated with Commvault services and integrations if exploitation is suspected.
• Ensure backups are immutable or otherwise protected from alteration and validate restore readiness.