CVEvulnerability

CVE-2025-3928

8.7 HIGH Known exploited Published 2025-04-25 Modified 2026-10-08 Official page ↗

CISA Known Exploited Vulnerability

Commvault Web Server Unspecified Vulnerability — Commvault Web Server

Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.

Added to KEV
2025-04-28
Remediation due
2025-05-19
Ransomware use
Unknown
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes
https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html; https://www.commvault.com/blogs/notice-security-advisory-update; https://nvd.nist.gov/vuln/detail/CVE-2025-3928
Status
Analyzed
Published
2025-04-25
Last modified
2026-10-08
Assigner
9119a7d8-5eab-497f-8521-727c672e3725
CVSS 4.0 (9119a7d8-5eab-497f-8521-727c672e3725)
8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 (9119a7d8-5eab-497f-8521-727c672e3725)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94

Description

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.

Affected configurations

• commvault commvault (>= 11.20.0 < 11.20.217) • commvault commvault (>= 11.28.0 < 11.28.141) • commvault commvault (>= 11.32.0 < 11.32.89) • commvault commvault (>= 11.36.0 < 11.36.46)

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References