CVE-2025-3928: Commvault Web Server unspecified vulnerability

Description

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.5% · higher than 85% of CVEs

Exploited in the wildYes

CISA KEVListed Apr 28, 2025

Federal remediation dueMay 19, 2025

Ransomware campaign useNot known

Affected products

Which versions

WS

Web Server · Commvault

11.36.0 before 11.36.46; 11.32.0 before 11.32.89; 11.28.0 before 11.28.141; 11.20.0 before 11.20.217 · source: vendor, KEV

CO

Commvault · Commvault

11.20.0 before 11.20.217; 11.28.0 before 11.28.141; 11.32.0 before 11.32.89; 11.36.0 before 11.36.46 · source: NVD