# CVE-2025-3928

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.

- Page: https://www.vulneraibility.com/cve/CVE-2025-3928
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2025-04-28; CISA due date 2025-05-19
- EPSS: 2.53%
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-04-30)
- Weakness: CWE-94
- Published: 2025-04-25

## Affected versions

- Commvault Web Server: affected >= 11.36.0 and < 11.36.46; >= 11.32.0 and < 11.32.89; >= 11.28.0 and < 11.28.141; >= 11.20.0 and < 11.20.217; fixed in 11.36.46, 11.32.89, 11.28.141, 11.20.217

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928
- [other] https://www.commvault.com/blogs/security-advisory-march-7-2025
- [other] https://www.commvault.com/blogs/notice-security-advisory-update
- [other] https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic
- [other] https://www.commvault.com/blogs/customer-security-update
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928
- [other] https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.