HIGH

CVE-2025-3928

Commvault Commvault 2025-04-25 CVSS v3.1

CVSS

8.8

KEV

Description

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.

Summary dbcve.org

Commvault Web Server contains a vulnerability allowing remote, authenticated attackers to create and execute webshells on the affected system. This enables arbitrary code execution with the privileges of the web server process, leading to potential complete system compromise. The CVSS 8.8 indicates network-based exploitation with high confidentiality and availability impact.

Mitigation

Upgrade Commvault to version 11.36.46, 11.32.89, 11.28.141, or 11.20.217 (or later) for both Windows and Linux platforms. Since this vulnerability is actively exploited (CISA KEV), prioritize patching immediately and audit for indicators of compromise.

EPSS Score

2.14%

Probability of exploitation in next 30 days

81.2th percentile

References

https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928 Third Party Advisory, US Government Resource https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic Third Party Advisory, US Government Resource https://www.commvault.com/blogs/customer-security-update Vendor Advisory https://www.commvault.com/blogs/notice-security-advisory-update Vendor Advisory https://www.commvault.com/blogs/security-advisory-march-7-2025 Vendor Advisory https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/ Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE