CVE-2025-3928

Commvault Web Server unspecified vulnerability

State: Published
Severity: 8.7 High
Published: Apr 25, 2025
Updated: Oct 7, 2026
Reserved: Apr 24, 2025

Description

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	cisa-cg
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	cisa-cg

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
Web ServerCommvault	11.36.0 to before 11.36.46Affected 11.36.46Not affected 11.32.0 to before 11.32.89Affected 11.32.89Not affected 11.28.0 to before 11.28.141Affected 11.28.141Not affected 11.20.0 to before 11.20.217Affected 11.20.217Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.