{"id":"CVE-2025-3928","published":"2025-04-25T16:15:27Z","modified":"2026-10-08T12:54:32Z","title":"Commvault Web Server Unspecified Vulnerability","vendor":"Commvault","product":"Web Server","tier":"core","eol":null,"description":{"text":"Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: \"Webservers can be compromised through bad actors creating and executing webshells.\" Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.","provenance":"source","from":"NVD"},"summary":{"text":"The Commvault Web Server product contains an unspecified vulnerability that allows webservers to be compromised through attackers creating and executing webshells, classified as a code injection weakness. A remote attacker with low-privilege authenticated access can exploit it, requiring no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:10Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.02527,"percentile":0.84849,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-04-28","dueDate":"2025-05-19","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html;   https://www.commvault.com/blogs/notice-security-advisory-update;   https://nvd.nist.gov/vuln/detail/CVE-2025-3928      ","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-03-07","exploitedFirstSeen":"2025-03-07","ransomware":false,"evidence":[{"url":"https://www.commvault.com/blogs/security-advisory-march-7-2025","date":"2025-03-07"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-04-28"},{"url":"https://www.commvault.com/blogs/customer-security-update","date":"2025-05-04"},{"url":"https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic","date":"2025-05-22"},{"url":"https://www.nextgov.com/cybersecurity/2025/05/china-linked-silk-typhoon-hackers-accessed-commvault-cloud-environments-person-familiar-says/405579/","date":"2025-05-23"},{"url":"https://www.withsecure.com/content/dam/with-secure/en/resources/THR_May25.pdf","date":"2025-06-25"},{"url":"https://medium.com/@nshcthreatrecon/monthly-threat-actor-group-intelligence-report-june-2025-3491df82965b","date":"2025-07-18"},{"url":"https://www.crowdstrike.com/en-us/blog/murky-panda-trusted-relationship-threat-in-cloud/","date":"2025-08-21"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"},{"url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report","date":"2026-02-25"}],"evidenceTotal":10,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://www.commvault.com/blogs/customer-security-update","tags":["Vendor Advisory"]},{"url":"https://www.commvault.com/blogs/notice-security-advisory-update","tags":["Broken Link","Vendor Advisory"]},{"url":"https://www.commvault.com/blogs/security-advisory-march-7-2025","tags":["Vendor Advisory"]},{"url":"https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928","tags":["US Government Resource"]}],"techniques":[{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"primary_impact","evidence":[],"comment":"While public technical details of this exploit are limited, including the techniques used, it is known that authenticated, low-privileged attackers were able to achieve remote code execution and web shell deployment.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"secondary_impact","evidence":[],"comment":"While public technical details of this exploit are limited, including the techniques used, it is known that authenticated, low-privileged attackers were able to achieve remote code execution and web shell deployment.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-12508","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-12508","exploited":true,"exploitedSince":"2025-04-28","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1505.003"],"provenance":"source"}],"timeline":[{"date":"2025-03-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.commvault.com/blogs/security-advisory-march-7-2025","provenance":"source"},{"date":"2025-04-25","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3928","provenance":"source"},{"date":"2025-04-28","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-04-28","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-12508","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":3},"priority":{"score":61.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 602 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.97,"detail":"percentile 0.8485"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}