Commvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791)

SigmaHQ Detections@sigmaHQ

•updated Oct 20, 2025•0•19

Detects the use of argument injection in the Commvault qlogin command, specifically targeting CVE-2025-57791. An attacker can inject the `-localadmin` parameter via the password field to bypass authentication and gain a privileged token.