VULNERABILITY INTELLIGENCE

CVE-2025-3928

CVSS score8.8 HIGH

EPSS probability2.53%

CISA KEVKnown exploited vulnerability

Published2025-04-25

Last modified2026-10-08

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Commvault Web Server Unspecified Vulnerability

Vendor / product: Commvault / Web Server

Description

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.

Weakness classification

nvd@nist.gov: NVD-CWE-noinfo
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-94

Primary references

9119a7d8-5eab-497f-8521-727c672e3725 — Vendor Advisory
9119a7d8-5eab-497f-8521-727c672e3725 — Third Party Advisory, US Government Resource
9119a7d8-5eab-497f-8521-727c672e3725 — Third Party Advisory, US Government Resource
9119a7d8-5eab-497f-8521-727c672e3725 — Vendor Advisory
9119a7d8-5eab-497f-8521-727c672e3725 — Broken Link, Vendor Advisory
9119a7d8-5eab-497f-8521-727c672e3725 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource