{"schema":"threatline.record/2","record":{"id":"CVE-2025-3928","aliases":[],"summary":"Commvault Web Server Unspecified Vulnerability","details":"Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.","categories":["Unclassified"],"product":"Web Server","vendor":"Commvault","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-3928","source_modified_at":"2026-10-07T17:54:32.426Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Web Server","vendor":"Commvault","versions":[{"version":"11.36.0","status":"affected","lessThan":"11.36.46","versionType":"custom"},{"version":"11.36.46","status":"unaffected"},{"version":"11.32.0","status":"affected","lessThan":"11.32.89","versionType":"custom"},{"version":"11.32.89","status":"unaffected"},{"version":"11.28.0","status":"affected","lessThan":"11.28.141","versionType":"custom"},{"version":"11.28.141","status":"unaffected"},{"version":"11.20.0","status":"affected","lessThan":"11.20.217","versionType":"custom"},{"version":"11.20.217","status":"unaffected"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-3928","source_modified_at":"2026-10-07T17:54:32.426Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Web Server","ecosystem":null},"version":"11.36.46","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-3928","source_modified_at":"2026-10-07T17:54:32.426Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Web Server","ecosystem":null},"version":"11.32.89","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-3928","source_modified_at":"2026-10-07T17:54:32.426Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Web Server","ecosystem":null},"version":"11.28.141","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-3928","source_modified_at":"2026-10-07T17:54:32.426Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Web Server","ecosystem":null},"version":"11.20.217","basis":"first unaffected version stated in the CVE record"}],"cvss":8.8,"severity":"High","kev":{"listed":true,"date_added":"2025-04-28","due_date":"2025-05-19","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","ransomware_campaign_use":"Unknown"},"epss":{"probability":0.02484,"percentile":0.84488,"score_date":"2026-10-23"},"published_at":"2025-04-25T15:56:28.112Z","modified_at":"2026-10-07T17:54:32.426Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-3928","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-07T17:54:32.426Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-3928","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html"},{"source":"CVE List","url":"https://www.commvault.com/blogs/notice-security-advisory-update"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3928","source":"CISA KEV"},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-3928"},{"source":"CVE List","url":"https://www.commvault.com/blogs/security-advisory-march-7-2025"},{"source":"CVE List","url":"https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic"},{"source":"CVE List","url":"https://www.commvault.com/blogs/customer-security-update"},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928","tags":["government-resource"]},{"source":"CVE List","url":"https://www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"no","technical_impact":"total","assessed_at":"2025-04-30T03:56:24.936967Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-07T17:54:32.426Z","content_hash":"d1be58f913046709e1e21dd31efa40cb5dea1077635c425408ee88ca64a5b4e1"}}