CVE-2025-3928: commvault — Actively Exploited & Fix

Description

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.

Is your site exposed to CVE-2025-3928?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild.

Added: Apr 28, 2025 Remediation due: May 19, 2025

Affected Products

Vendor	Product	Versions
commvault	commvault	11.20.0 — 11.20.217
commvault	commvault	11.28.0 — 11.28.141
commvault	commvault	11.32.0 — 11.32.89
commvault	commvault	11.36.0 — 11.36.46
linux	linux_kernel	All
microsoft	windows	All

References

Advisories & Patches

https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html https://www.commvault.com/blogs/customer-security-update https://www.commvault.com/blogs/notice-security-advisory-update https://www.commvault.com/blogs/security-advisory-march-7-2025

Other References

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928 https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/ https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928

Frequently Asked Questions

What is CVE-2025-3928? +

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28. It has a CVSS v3.1 base score of 8.8 (HIGH). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.

How severe is CVE-2025-3928? +

CVE-2025-3928 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-3928? +

CVE-2025-3928 affects products from commvault, linux, microsoft, specifically: commvault, linux_kernel, windows. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-3928? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-34028 10.0

The Commvault Command Center Innovation Release allows an unauthenticated actor to upload ZIP files that represent install packages that, when …

CVE-2026-77098 9.8

Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenance release. Update Private …

CVE-2026-77092 9.8

Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update …

CVE-2026-77089 9.8

Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update Command …

CVE-2026-77106 8.8

Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault …

CVE-2026-77105 8.8

CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and …

CVE-2025-3928