CVE-2025-3928
Commvault Web Server Unspecified Vulnerability
Description
CVE-2025-3928 is a high-severity vulnerability in the Commvault Web Server that allows a remote authenticated attacker to create and execute web shells, leading to full server compromise. The vulnerability is unspecified in nature but enables attackers to deploy malicious web shells that provide persistent remote access to the Commvault infrastructure. With a CVSS v3.1 score of 8.8 (HIGH), this vulnerability affects multiple Commvault versions across Windows and Linux platforms. CISA has added CVE-2025-3928 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 19, 2025, and the EPSS score of 18.09% at the 95.04th percentile reflects a very high probability of exploitation targeting enterprise backup infrastructure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| commvault | commvault | >= 11.20.0, < 11.20.217; >= 11.28.0, < 11.28.141; >= 11.32.0, < 11.32.89; >= 11.36.0, < 11.36.46 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic(Third Party Advisory, US Government Resource)
- https://www.commvault.com/blogs/customer-security-update(Vendor Advisory)
- https://www.commvault.com/blogs/notice-security-advisory-update(Vendor Advisory)
- https://www.commvault.com/blogs/security-advisory-march-7-2025(Vendor Advisory)
- https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928(US Government Resource)
Weakness Type
CVE-2025-3928 does not have a specific CWE classification assigned. The vulnerability enables remote authenticated attackers to create and execute web shells on the Commvault Web Server, suggesting weaknesses related to insufficient input validation, improper access controls on file upload or creation functionality, or inadequate restrictions on executable content within the web server environment. The exact technical mechanism has not been publicly disclosed by the vendor.
Impact Analysis
CVE-2025-3928 carries a CVSS v3.1 base score of 8.8 (HIGH) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-accessible attack (AV:N) with low complexity (AC:L) that requires only low-level privileges (PR:L) and no user interaction (UI:N). The ability to deploy web shells on a Commvault server has devastating consequences: Confidentiality (High) is fully compromised as Commvault systems contain backup data from across the enterprise, potentially including databases, file servers, email archives, and application data. Integrity (High) is at maximum risk because the attacker can modify backup configurations, corrupt backup data, or alter retention policies to facilitate data destruction. Availability (High) can be fully impacted through disruption of backup operations, deletion of backup copies, or ransomware deployment targeting the backup infrastructure specifically. The EPSS score of 18.1% at the 95.0th percentile indicates a very high probability of exploitation, and CISA has specifically issued an advisory about cyber threat activity targeting Commvault's SaaS cloud application, highlighting the strategic value of backup systems to attackers.
Exploit Maturity
CVE-2025-3928 has been confirmed as actively exploited in the wild through its inclusion in CISA's Known Exploited Vulnerabilities catalog. CISA published a dedicated advisory on cyber threat activity targeting Commvault's SaaS cloud application (Metallic), underscoring the severity of the exploitation campaigns. The EPSS score of 18.1% at the 95.0th percentile indicates a very high probability of exploitation, confirming widespread targeting. Commvault has published multiple security advisories and blog posts addressing the situation, including a security advisory from March 2025 and subsequent updates. Backup infrastructure is an especially high-value target for threat actors, particularly ransomware operators, because compromising backup systems eliminates the victim's ability to recover without paying the ransom. The combination of active exploitation and the critical role of Commvault in enterprise data protection makes this vulnerability an urgent priority.
Remediation
-
Apply Commvault patches immediately. Update to one of the fixed versions: 11.36.46, 11.32.89, 11.28.141, or 11.20.217, depending on your current version branch. Consult the Commvault security advisory CV_2025_03_1 for specific guidance.
-
Scan for web shells. Conduct a thorough scan of the Commvault Web Server directories for any unauthorized files, particularly scripts (PHP, ASPX, JSP) or other executable content that could function as web shells. Check file creation timestamps and compare against known deployment activities.
-
Restrict web server access. Limit access to the Commvault Web Server interface to authorized administrators from trusted network segments only. Implement IP-based access controls and ensure the web interface is not exposed to the internet.
-
Review authentication and access logs. Audit all user accounts with access to the Commvault Web Server, disable unnecessary accounts, and enforce multi-factor authentication. Review access logs for suspicious login patterns or unauthorized file operations.
-
Validate backup integrity. Verify the integrity of existing backups to ensure they have not been tampered with. Test restore operations to confirm backup data is recoverable and has not been corrupted by potential attackers.
Technical Details
CVE-2025-3928 is an unspecified vulnerability in the Commvault Web Server component that enables web shell deployment. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a network-accessible attack requiring only low-level authentication with low complexity and no user interaction.
According to the Commvault advisory, the vulnerability allows web servers to be compromised through the creation and execution of web shells by authenticated attackers. While the specific technical mechanism has not been fully disclosed, web shell attacks typically involve exploiting a file upload or creation capability to place executable code on the server, followed by triggering execution through direct HTTP requests. The vulnerability affects Commvault versions across multiple branches: 11.36.x (before 11.36.46), 11.32.x (before 11.32.89), 11.28.x (before 11.28.141), and 11.20.x (before 11.20.217), on both Windows and Linux platforms. The broad range of affected versions and platforms suggests a fundamental flaw in the web server's handling of file operations or content execution rather than a platform-specific issue.
Frequently Asked Questions
Is CVE-2025-3928 being actively exploited?
Yes. CISA has confirmed active exploitation and issued a dedicated advisory about threat activity targeting Commvault's cloud infrastructure. The EPSS score of 18.09% at the 95.04th percentile confirms a very high exploitation probability.
What products are affected by CVE-2025-3928?
Commvault Web Server versions 11.20.0 through 11.20.216, 11.28.0 through 11.28.140, 11.32.0 through 11.32.88, and 11.36.0 through 11.36.45 are affected on both Windows and Linux platforms.
How do I fix CVE-2025-3928?
Update Commvault to version 11.36.46, 11.32.89, 11.28.141, or 11.20.217 depending on your version branch. Scan for existing web shells and restrict web server access to authorized networks.
How severe is CVE-2025-3928?
With a CVSS v3.1 score of 8.8 (HIGH), CVE-2025-3928 is a serious vulnerability. The ability to deploy web shells on backup infrastructure makes this particularly dangerous, as it can lead to complete compromise of enterprise backup systems and data.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.