CVE-2025-3928

66

FAUCET Score

CVE-2025-3928 is an unspecified vulnerability in Commvault Web Server, affecting both Windows and Linux platforms, that allows remote, authenticated attackers to compromise web servers by creating and executing webshells. With a CVSS score of 8.8 (HIGH), this flaw is easily exploitable over the network with low complexity, enabling full compromise of confidentiality, integrity, and availability. This vulnerability is actively exploited as a zero-day, confirmed by Commvault and added to the CISA KEV Catalog, and has garnered significant community discussion and media coverage, indicating widespread awareness and concern. While no public exploit code is currently available, its active exploitation necessitates immediate patching to versions 11.36.46, 11.32.89, 11.28.141, or 11.20.217.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 11.20.0, < 11.20.217CPE matchmatch criteria	cpe:2.3:a:commvault:commvault::::::::
		>= 11.28.0, < 11.28.141CPE matchmatch criteria	cpe:2.3:a:commvault:commvault::::::::
		>= 11.32.0, < 11.32.89CPE matchmatch criteria	cpe:2.3:a:commvault:commvault::::::::
		>= 11.36.0, < 11.36.46CPE matchmatch criteria	cpe:2.3:a:commvault:commvault::::::::

CVSS Data

CVSS version used by this source: 4.0

8.7HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

LOW

User Interaction

NONE

VS Confidentiality

HIGH

VS Integrity

HIGH

VS Availability

HIGH

SS Confidentiality

NONE

SS Integrity

NONE

SS Availability

NONE

Exploit Maturity

NOT_DEFINED

CvssVersion

4.0

Exploit Intelligence

EPSS Score

1.98%

Probability of exploitation in next 30 days

EPSS Percentile

78.5%

Percentile rank of EPSS score among Peer Group

As of 2026-07-26

Model: v2026.06.15

Added to KEV · Apr 28, 2025

This CVE's current EPSS score of 0.0198 is in the 77th percentile among its peer group of 17,823 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (8)

barracudapatch availablevia llm_extracted

boschpatch availablevia llm_extracted

clamavpatch availablevia llm_extracted

consulpatch availablevia llm_extracted

freshrsspatch availablevia llm_extracted

qdrantpatch availablevia llm_extracted

symantecpatch availablevia llm_extracted

verbbpatch availablevia llm_extracted

Vendor Advisories (8)

barracudallm-barracuda-ff1eb2f2d535ddf4CRITICAL

Critical Webserver Vulnerability

symantecllm-symantec-54ff2b66ddf0336d

Critical Webserver Vulnerability

verbbllm-verbb-a96b8205ffe7b73b

Critical Webserver Vulnerability

consulllm-consul-f746ecbac0c5bc37

Critical Webserver Vulnerability

clamavllm-clamav-5a75ca3ec9b3dbdc

Critical Webserver Vulnerability

boschllm-bosch-2a4f6a054e7bb313CRITICAL

Critical Webserver Vulnerability

freshrssllm-freshrss-318064d6c184480e

Critical Webserver Vulnerability

qdrantllm-qdrant-a267737f8c578340

Critical Webserver Vulnerability

References

cisa.gov / known-exploited-vulnerabilities-catalog

US Government Resource

documentation.commvault.com / securityadvisories/CV_2025_03_1.html

Vendor Advisory

cisa.gov / known-exploited-vulnerabilities-catalog

Third Party AdvisoryUS Government Resource

cisa.gov / news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic

Third Party AdvisoryUS Government Resource

commvault.com / blogs/customer-security-update

Vendor Advisory

commvault.com / blogs/notice-security-advisory-update

Vendor Advisory

commvault.com / blogs/security-advisory-march-7-2025

Vendor Advisory

bleepingcomputer.com / news/security/commvault-says-recent-breach-didnt-impact-customer-backup-data

Third Party Advisory