What’s Vulnerable › Vulnerabilities

CVE-2025-3928: Commvault Web Server Unspecified Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-04-28
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-25 · updated 2026-10-08
• Weakness: CWE-94

Description

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.

Affected products

• Commvault Cloud: from 11.20.0 before 11.20.217; from 11.28.0 before 11.28.141; from 11.32.0 before 11.32.89; from 11.36.0 before 11.36.46 — fixed in 11.20.217, 11.28.141, 11.32.89, 11.36.46

How to fix

Upgrade to a fixed version: Commvault Cloud 11.20.217, 11.28.141, 11.32.89, 11.36.46. Check the vendor advisory for mitigations.

References

• https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928
• https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic
• https://www.commvault.com/blogs/customer-security-update
• https://www.commvault.com/blogs/notice-security-advisory-update
• https://www.commvault.com/blogs/security-advisory-march-7-2025
• https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928

Get alerted when CVE-2025-3928 or the next vulnerability affects your stack