CVE-2025-3928
Commvault Web Server Unspecified Vulnerability - [Actively Exploited]
Description
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.
INFO
Published Date :
April 25, 2025, 4:15 p.m.
Last Modified :
May 6, 2025, 8:52 p.m.
Source :
9119a7d8-5eab-497f-8521-727c672e3725
Remotely Exploitable :
Yes !
Impact Score :
5.9
Exploitability Score :
2.8
CISA KEV (Known Exploited Vulnerabilities)
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-3928
Public PoC/Exploit Available at Github
CVE-2025-3928 has a 3 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
Affected Products
The following products are affected by CVE-2025-3928
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-3928.
| URL | Resource |
|---|---|
| https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928 | Third Party Advisory US Government Resource |
| https://www.commvault.com/blogs/notice-security-advisory-update | Vendor Advisory |
| https://www.commvault.com/blogs/security-advisory-march-7-2025 | Vendor Advisory |
| https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/ | Third Party Advisory |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
None
None
Shell Ruby HTML JavaScript SCSS Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-3928 vulnerability anywhere in the article.
-
Cyber Security News
Detecting Vulnerable Commvault Environments Within Azure Using KQL Query
Cybersecurity analysts are racing to respond to an active exploitation campaign targeting Commvault environments in Microsoft Azure through the recently identified CVE-2025-3928 vulnerability. This cr ... Read more
-
The Hacker News
Commvault CVE-2025-34028 Added to CISA KEV After Active Exploitation Confirmed
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a maximum-severity security flaw impacting Commvault Command Center to its Known Exploited Vulnerabilities (KEV) catalog, a l ... Read more
-
The Register
Microsoft tries to knife passwords once and for all - at least for consumers
Infosec In Brief Microsoft has decided to push its consumer customers to dump password in favor of passkeys. The software giant announced the move Thursday, May 1, traditionally known as "World Passwo ... Read more
-
Help Net Security
Week in review: Critical SAP NetWeaver flaw exploited, RSAC 2025 Conference
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: RSAC 2025 Conference RSAC 2025 Conference took place at the Moscone Center in San Francisco. Check out ... Read more
-
The Hacker News
Commvault Confirms Hackers Exploited CVE-2025-3928 as Zero-Day in Azure Breach
Zero-Day / Threat Intelligence Enterprise data backup platform Commvault has revealed that an unknown nation-state threat actor breached its Microsoft Azure environment by exploiting CVE-2025-3928 but ... Read more
-
Cyber Security News
Commvault Confirms 0-Day Exploit Allowed Hackers Access to Its Azure Environment
Commvault, a leading provider of data protection solutions, has confirmed that a nation-state threat actor breached its Azure environment in February by exploiting a zero-day vulnerability. The compan ... Read more
-
BleepingComputer
Commvault says recent breach didn't impact customer backup data
Commvault, a leading provider of data protection solutions, says a nation-state threat actor who breached its Azure environment didn't gain access to customer backup data. Listed on NASDAQ since March ... Read more
-
Help Net Security
44% of the zero-days exploited in 2024 were in enterprise solutions
In 2024, threat actors exploited 75 zero-days – i.e., vulnerabilities previously unknown to vendors, thus without a readily available patch – in a wide variety of attacks. Of these, 33 vulnerabilities ... Read more
-
BleepingComputer
CISA tags Broadcom Fabric OS, CommVault flaws as exploited in attacks
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning of Broadcom Brocade Fabric OS, Commvault web servers, and Qualitia Active! Mail clients vulnerabilities that are actively expl ... Read more
-
Help Net Security
CISA warns about actively exploited Broadcom, Commvault vulnerabilities
The Cybersecurity and Infrastructure Security Agency (CISA) has added three new flaws to its Known Exploited Vulnerabilities catalog on Monday, affecting Commvault (CVE-2025-3928), Active! Mail (CVE-2 ... Read more
-
security.nl
VS meldt actief misbruik van beveiligingslek in Commvault-webserver
Aanvallers maken actief misbruik van een kwetsbaarheid in Commvault-webserver, zo meldt het Cybersecurity and Infrastructure Security Agency (CISA) van het Amerikaanse ministerie van Homeland Security ... Read more
-
TheCyberThrone
CISA Adds ThreeVulnerabilities to KEV Catalog
The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) Catalog with new additions, highlighting active exploitation of critical vulnerabiliti ... Read more
-
Cyber Security News
Apache Tomcat Vulnerability Let Attackers Bypass Rules & Trigger DoS Condition
The Apache Software Foundation disclosed a significant security vulnerability in Apache Tomcat that could allow attackers to bypass security rules and trigger denial-of-service conditions through mani ... Read more
-
Cyber Security News
CISA Issues Warning on Commvault Web Server Flaw Exploited in the Wild
The Cybersecurity and Infrastructure Security Agency (CISA) has added the Commvault Web Server vulnerability (CVE-2025-3928) to its Known Exploited Vulnerabilities (KEV) catalog, indicating that threa ... Read more
-
The Hacker News
CISA Adds Actively Exploited Broadcom and Commvault Flaws to KEV Database
Vulnerability / Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added two high-severity security flaws impacting Broadcom Brocade Fabric OS and Commvault Web Se ... Read more
The following table lists the changes that have been made to the
CVE-2025-3928 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Modified Analysis by [email protected]
May. 06, 2025
Action Type Old Value New Value Added Reference Type CVE: https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/ Types: Third Party Advisory -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
May. 05, 2025
Action Type Old Value New Value Added Reference https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/ -
Modified Analysis by [email protected]
May. 02, 2025
Action Type Old Value New Value Added Reference Type Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928 Types: Third Party Advisory, US Government Resource Added Reference Type Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government: https://www.commvault.com/blogs/notice-security-advisory-update Types: Vendor Advisory Added Reference Type Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government: https://www.commvault.com/blogs/security-advisory-march-7-2025 Types: Vendor Advisory -
CVE Modified by 9119a7d8-5eab-497f-8521-727c672e3725
May. 02, 2025
Action Type Old Value New Value Changed Description Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28. Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928 Added Reference https://www.commvault.com/blogs/notice-security-advisory-update Added Reference https://www.commvault.com/blogs/security-advisory-march-7-2025 -
CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725
Apr. 30, 2025
Action Type Old Value New Value Changed Due Date 2025-05-17 2025-05-19 -
Initial Analysis by [email protected]
Apr. 29, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE NVD-CWE-noinfo Added CPE Configuration AND OR *cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:* versions from (including) 11.20.0 up to (excluding) 11.20.217 *cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:* versions from (including) 11.28.0 up to (excluding) 11.28.141 *cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:* versions from (including) 11.32.0 up to (excluding) 11.32.89 *cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:* versions from (including) 11.36.0 up to (excluding) 11.36.46 OR cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Added Reference Type Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government: https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html Types: Vendor Advisory -
CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725
Apr. 29, 2025
Action Type Old Value New Value Added Date Added 2025-04-28 Added Due Date 2025-05-17 Added Required Action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Added Vulnerability Name Commvault Web Server Unspecified Vulnerability -
New CVE Received by 9119a7d8-5eab-497f-8521-727c672e3725
Apr. 25, 2025
Action Type Old Value New Value Added Description Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added Reference https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-3928 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-3928
weaknesses.