Commvault
CVE-2025-3928
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | High risk (CVSS 8.7, EPSS 16.6%). Backup infrastructure is a prime ransomware target. Compromising Commvault allows attackers to delete or encrypt backups before deploying ransomware, ensuring victims cannot recover. |
| Exploit ScenarioDerived | Ransomware operators compromise Commvault credentials, deploy a web shell through the vulnerability, then delete backup jobs and data before encrypting the production environment, maximizing the impact of their ransomware deployment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
Commvault Web Server allows authenticated remote attackers to create and execute webshells, exploited in the wild alongside CVE-2025-34028 for comprehensive backup infrastructure compromise.
Earlier versions of this analysis (1)
An unspecified vulnerability in Commvault Web Server allows authenticated remote attackers to create and execute web shells, providing persistent remote code execution on the backup management server.
RemediationAI
Apply Commvault security updates. Implement MFA for Commvault admin access. Monitor for web shell creation. Implement immutable backup storage.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability allows bad actors to compromise Commvault webservers through webshell creation and execution. While requiring authentication, compromised credentials or chaining with other vulnerabilities enables exploitation.
Know when Commvault gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (9119a7d8-5eab-497f-8521-727c672e3725) · only source for this CVE.
CVSS VectorVendor: 9119a7d8-5eab-497f-8521-727c672e3725
Lifecycle Timeline
2DescriptionCVE.org
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.
Executive ViewAI
Organizations using Commvault Web Server face significant risk from CVE-2025-3928 rated CVSS 8.7. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Commvault Command Center Innovation Release allows unauthenticated remote code execution through path traversal in ZIP f
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user
A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access thr
Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack
A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments
In CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13, D
During the brief window between installation and the first administrator login, remote attackers may exploit the default
The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted seri
Unauthenticated remote command execution in Commvault CVFS, the file system component shipped with Commvault Grid (Hyper
Authentication bypass in the Commvault Command Center API allows remote unauthenticated attackers to circumvent privileg
Authorization bypass in Commvault CommServe allows remote attackers to invoke a limited set of command-execution operati
Authorization bypass in Commvault CommServe permits attackers to circumvent the command-execution allowlist, gaining uns
GitHub PoC
Exploit-DB