Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790)

SigmaHQ Detections@sigmaHQ

•updated Oct 20, 2025•1•0•24

Detects the use of qoperation.exe with specific command-line arguments to write a JSP file to the webroot, indicating a webshell drop. This activity is associated with a post-authentication step related to CVE-2025-57790, which involves a path traversal vulnerability in Commvault.