CVE-2025-3928

🗓️ 25 Apr 2025 16:15:27Reported by [email protected]Type

Commvault Web Server has a vulnerability exploitable by remote attackers; fixed in recent versions.

Reporter	Title	Published	Views	Family All 23
ATTACKERKB	CVE-2025-3928	25 Apr 202500:00	–	attackerkb
BDU FSTEC	The vulnerability of CommVault’s backup and disaster recovery web server allows a perpetrator to execute arbitrary code.	5 May 202500:00	–	bdu_fstec
Circl	CVE-2025-3928	25 Apr 202516:07	–	circl
CISA KEV Catalog	Commvault Web Server Unspecified Vulnerability	28 Apr 202500:00	–	cisa_kev
CISA	Advisory Update on Cyber Threat Activity Targeting Commvault’s SaaS Cloud Application (Metallic)	22 May 202512:00	–	cisa
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	28 Apr 202512:00	–	cisa
CNNVD	Commvault Web Server 安全漏洞	25 Apr 202500:00	–	cnnvd
Tenable Nessus	Commvault Critical Webserver Vulnerability (CV_2025_03_1)	13 Mar 202500:00	–	nessus
CVE	CVE-2025-3928	25 Apr 202515:56	–	cve
Cvelist	CVE-2025-3928 Commvault Web Server unspecified vulnerability	25 Apr 202515:56	–	cvelist

NVD

Node

commvault commvaultRange11.20.0–11.20.217

commvault commvaultRange11.28.0–11.28.141

commvault commvaultRange11.32.0–11.32.89

commvault commvaultRange11.36.0–11.36.46

AND

Source	Link
bleepingcomputer	www.bleepingcomputer.com/news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
commvault	www.commvault.com/blogs/notice-security-advisory-update
documentation	www.documentation.commvault.com/securityadvisories/CV_2025_03_1.html
commvault	www.commvault.com/blogs/customer-security-update
commvault	www.commvault.com/blogs/security-advisory-march-7-2025
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
cisa	www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic

17 Jun 2026 09:20Current

CVSS 3.18.8

CVSS 48.7

EPSS0.01868