CVE-2025-3928
8.7 high
KEV · due 2025-05-19
SSVC exploitation: none
Analyzed
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.
Fix
CISA KEV required action · due 2025-05-19
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Added to the catalog 2025-04-28. CISA KEV
Patch, vendor advisory and mitigation references on NVD 4
- https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html Vendor Advisory
- https://www.commvault.com/blogs/customer-security-update Vendor Advisory
- https://www.commvault.com/blogs/notice-security-advisory-update Broken Link, Vendor Advisory
- https://www.commvault.com/blogs/security-advisory-march-7-2025 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.7 · in KEV · commvaultNVD modified 2026-10-08 12:54
Affected (CPE criteria) 1
cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:*
References 8
- https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928 Third Party Advisory, US Government Resource
- https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic Third Party Advisory, US Government Resource
- https://www.commvault.com/blogs/customer-security-update Vendor Advisory
- https://www.commvault.com/blogs/notice-security-advisory-update Broken Link, Vendor Advisory
- https://www.commvault.com/blogs/security-advisory-march-7-2025 Vendor Advisory
- https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/ Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928 US Government Resource