CVE-2025-3928highunder attackCWE-94

CVE-2025-3928: high-severity vulnerability in Commvault Web Server

Commvault Web Server unspecified vulnerability

Published · Updated

Follow this CVE+ Monitor Web Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.7epss 2.5%
from disclosure to weapon
Published on NVDApr 25
CISA KEV+3d
Action required by CISAfederal deadline: 2025-05-19

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Commvault Web Server has a security flaw that allows authenticated attackers to upload and run malicious code (webshells) on the server, potentially taking it over. This is a serious threat because attackers can gain full control of the system.

Technical detail

Remote authenticated attackers can exploit an unspecified vulnerability in Commvault Web Server to create and execute webshells, achieving arbitrary code execution on affected systems. The vulnerability affects multiple versions across Windows and Linux platforms and requires valid credentials. Patched in versions 11.36.46, 11.32.89, 11.28.141, and 11.20.217.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Commvault · Web Server