All vulnerabilities
CVE-2025-3928

Commvault Web Server Unspecified Vulnerability

Commvault Web Server
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationExploited in the wildAdded to KEV 28 Apr 2025CISA KEV
Exploit odds (EPSS)2.48%Chance of exploitation activity in the next 30 days, higher than 84% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in11.36.46Also 11.32.89, 11.28.141 and 1 moreCVE List
Federal deadline19 May 2025Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 25 Apr 2025, 15:56 UTCPublishedCVE List
  2. 28 Apr 2025Added to CISA KEVCISA KEV

Description

Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.

Text from CVE List

Affected versions 8

  • Web Serveraffected: 11.36.0 before 11.36.46CVE List
  • Web Serverunaffected: 11.36.46CVE List
  • Web Serveraffected: 11.32.0 before 11.32.89CVE List
  • Web Serverunaffected: 11.32.89CVE List
  • Web Serveraffected: 11.28.0 before 11.28.141CVE List
  • Web Serverunaffected: 11.28.141CVE List
  • Web Serveraffected: 11.20.0 before 11.20.217CVE List
  • Web Serverunaffected: 11.20.217CVE List

References 9