CVE-2025-3928Commvault Web Server unspecified vulnerability

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.

8.7 HIGHEPSS 2.52%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-10-08 12:54 UTC

OverviewCVSS details

8.7HIGHCVSS 4.0

Score source: cisa-cg (CNA)
NVD status: Analyzed
Published: Apr 25, 2025
Assigner: cisa-cg

Affected

Web Server (Commvault)

Versions: 11.36.0 before 11.36.46 · 11.32.0 before 11.32.89
Fixed in: 11.36.46, 11.32.89, 11.28.141

All affected versions →

Exploitation

Public exploit: None listed
CISA KEV: Listed · Apr 28, 2025
KEV due date: May 19, 2025
Ransomware use: Unknown
SSVC: Exploitation none · Automatable no · Impact total

EPSS · FIRST, scored Nov 7

2.52%chance of exploitation in 30 days

Higher than 84.98% of CVEs

CVSS 4.0 · cisa-cg (CNA)

8.7High

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: Low
User interaction: None
Confidentiality impact: High
Integrity impact: High
Availability impact: High
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · cisa-cg (CNA)

8.8High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
8.7	HIGH	4.0cisa-cg (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8	HIGH	3.1cisa-cg (CNA)	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA required action

⚡ Known exploited · remediation due May 19, 2025

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Details

CVE ID: CVE-2025-3928
Status: Analyzed
Assigner (CNA): cisa-cg
Published: Apr 25, 2025
Last modified: 2026-10-08 12:54 UTC
Weaknesses: CWE-94

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-07 15:58 UTC.