CVE-2025-3928
KEVCommvault Web Server Unspecified Vulnerability
Description
Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.
CVSS 4.0 vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XPublishedApr 25, 2025
Last modifiedOct 8, 2026
Added to KEVApr 28, 2025
Remediation dueMay 19, 2025
References
- documentation.commvault.com/securityadvisories/CV_2025_03_1.htmlVendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928Third Party AdvisoryUS Government Resource
- cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallicThird Party AdvisoryUS Government Resource
- commvault.com/blogs/customer-security-updateVendor Advisory
- commvault.com/blogs/notice-security-advisory-updateBroken LinkVendor Advisory
- commvault.com/blogs/security-advisory-march-7-2025Vendor Advisory
- bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/Third Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928US Government Resource
0 recent articles mention this CVE
74
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 525 days
- CVSS
- 8.7 HIGH
- EPSS (30-day exploit probability)
- 2.5% · top 15% of all CVEs
- Weakness
- NVD-CWE-noinfo
- Attack vector
- Network, remotely reachable
Recommended actions
- 1.Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.