Web Server Vulnerability in Commvault Affects Remote User Security
CVE-2025-3928

8.7HIGH

Key Information:

Vendor: Commvault
Status: Web Server
Vendor: CVE Published:; 25 April 2025

Badges

📈 Trended📈 Score: 2,220💰 Ransomware👾 Exploit Exists🟣 EPSS 11%🦅 CISA Reported📰 News Worthy

What is CVE-2025-3928?

CVE-2025-3928 is a vulnerability found in the Commvault Web Server, which is a component of Commvault's data protection and management software. This software is commonly used by organizations to manage backups, recover data, and ensure secure data storage operations. The vulnerability allows a remote, authenticated attacker to potentially compromise the web server via webshells, posing a significant risk to the security and integrity of an organization’s data and systems. If exploited, this could lead to unauthorized access and control, undermining the trust placed in the software for safeguarding sensitive information.

Technical Details

The vulnerability, described as unspecified, enables attackers to execute malicious webshells on the Commvault Web Server. This exploitation route is particularly alarming because it allows an attacker who has already authenticated to gain elevated access, which could enable them to manipulate web server functionalities or access sensitive data stored within the environment. The affected versions are those prior to the patched versions released, including 11.20.217, 11.28.141, 11.32.89, and 11.36.46, applicable to both Windows and Linux platforms. Organizations are strongly advised to apply necessary updates to mitigate the risk associated with this vulnerability.

Potential impact of CVE-2025-3928

Unauthorized Access: The ability for attackers to execute webshells could allow them to gain unauthorized control over the web server, potentially exposing critical data to unauthorized individuals.
Data Compromise: Exploitation of the vulnerability can lead to significant data breaches, as attackers may access and exfiltrate sensitive information stored within the backup and data management systems.
Operational Disruption: A successful attack could disrupt normal operations of the Commvault system, impacting backup and recovery processes and potentially leading to extended downtimes for organizations relying on these services for data protection.

CISA has reported CVE-2025-3928

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2025-3928 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.