CVE-2025-3928

🗓️ 25 Apr 2025 15:56:28Reported by cisa-cgType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 288 Views

Commvault Web Server has a remote vulnerability fixed in multiple versions for Windows and Linux.

Reporter	Title	Published	Views	Family All 22
ATTACKERKB	CVE-2025-3928	25 Apr 202500:00	–	attackerkb
Circl	CVE-2025-3928	25 Apr 202516:07	–	circl
CISA KEV Catalog	Commvault Web Server Unspecified Vulnerability	28 Apr 202500:00	–	cisa_kev
CISA	Advisory Update on Cyber Threat Activity Targeting Commvault’s SaaS Cloud Application (Metallic)	22 May 202512:00	–	cisa
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	28 Apr 202512:00	–	cisa
CNNVD	Commvault Web Server 安全漏洞	25 Apr 202500:00	–	cnnvd
Tenable Nessus	Commvault Critical Webserver Vulnerability (CV_2025_03_1)	13 Mar 202500:00	–	nessus
Cvelist	CVE-2025-3928 Commvault Web Server unspecified vulnerability	25 Apr 202515:56	–	cvelist
EUVD	EUVD-2025-12508	25 Apr 202515:56	–	euvd
NVD	CVE-2025-3928	25 Apr 202516:15	–	nvd

NVD

Node

commvault commvaultRange11.20.0–11.20.217

commvault commvaultRange11.28.0–11.28.141

commvault commvaultRange11.32.0–11.32.89

commvault commvaultRange11.36.0–11.36.46

AND

linux linux_kernelMatch-

microsoft windowsMatch-

[
  {
    "vendor": "Commvault",
    "product": "Web Server",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "11.36.0",
        "status": "affected",
        "lessThan": "11.36.46",
        "versionType": "custom"
      },
      {
        "version": "11.36.46",
        "status": "unaffected"
      },
      {
        "version": "11.32.0",
        "status": "affected",
        "lessThan": "11.32.89",
        "versionType": "custom"
      },
      {
        "version": "11.32.89",
        "status": "unaffected"
      },
      {
        "version": "11.28.0",
        "status": "affected",
        "lessThan": "11.28.141",
        "versionType": "custom"
      },
      {
        "version": "11.28.141",
        "status": "unaffected"
      },
      {
        "version": "11.20.0",
        "status": "affected",
        "lessThan": "11.20.217",
        "versionType": "custom"
      },
      {
        "version": "11.20.217",
        "status": "unaffected"
      }
    ]
  }
]

Source	Link
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
commvault	www.commvault.com/blogs/security-advisory-march-7-2025
documentation	www.documentation.commvault.com/securityadvisories/CV_2025_03_1.html
commvault	www.commvault.com/blogs/customer-security-update
commvault	www.commvault.com/blogs/notice-security-advisory-update
cisa	www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic
bleepingcomputer	www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

31 Oct 2025 21:59Current

8.7High risk

Vulners AI Score8.7

CVSS 3.18.8

CVSS 48.7

EPSS0.28635

SSVC

In Wild