Commvault Authentication Bypass via QCommand Argument Injection (WT-2025-0050)

Tim Peck@timpeck

•updated Nov 10, 2025•0•21

This rule detects attempts to exploit a known authentication bypass vulnerability in Commvault via QCommand Argument Injection. The detection specifically looks for HTTP POST requests to the '/commandcenter/api/Login' endpoint with specific content in the request body, including '_localadmin__' and 'commserver', along with a PCRE match for '-cs' preceded by a space or URL-encoded space, indicating an attempt to inject arguments.