Vulnerability details
CVE-2025-3928
Actively exploited
Commvault Web Server
Commvault Web Server unspecified vulnerability
CVSS 4.0
8.7High
Remedy
Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2025-05-19)
Versions not listed as affected in the CVE record:
- Web Server — version 11.36.46 and later
- Web Server — version 11.32.89 and later
- Web Server — version 11.28.141 and later
- Web Server — version 11.20.217 and later
Official description
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 4.0 | CVEProject cvelistV5 (CNA) (cisa-cg) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 8.8High | 3.1 | CVEProject cvelistV5 (CNA) (cisa-cg) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Commvault | Web Server | 11.20.0 ≤ v < 11.20.217 | CVEProject cvelistV5 (CNA) |
| Commvault | Web Server | 11.28.0 ≤ v < 11.28.141 | CVEProject cvelistV5 (CNA) |
| Commvault | Web Server | 11.32.0 ≤ v < 11.32.89 | CVEProject cvelistV5 (CNA) |
| Commvault | Web Server | 11.36.0 ≤ v < 11.36.46 | CVEProject cvelistV5 (CNA) |
References and advisories
8- https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928
- https://www.commvault.com/blogs/security-advisory-march-7-2025
- https://www.commvault.com/blogs/notice-security-advisory-update
- https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic
- https://www.commvault.com/blogs/customer-security-update
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928 government-resource
- https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-04-25
- Last updated
- 2026-10-07
- State
- Published
- Assigner (CNA)
- cisa-cg
- Kolun priority
- 74 · High
CISA KEV catalog
- Date added
- 2025-04-28
- Due date
- 2025-05-19
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
2.52%
Probability of exploitation in 30 days
85%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-94Improper Control of Generation of Code ('Code Injection')