CVE-2025-3928: 
Commvault vulnerability analysis and mitigation

Commvault Web Server contains a critical vulnerability (CVE-2025-3928) that allows remote authenticated attackers to create and execute webshells. The vulnerability was discovered in February 2025 and was initially exploited as a zero-day by a nation-state threat actor. The affected versions include Commvault software versions 11.20.0-11.20.216, 11.28.0-11.28.140, 11.32.0-11.32.88, and 11.36.0-11.36.45 on both Windows and Linux platforms (Commvault Advisory).

The vulnerability has received a CVSS v4.0 score of 8.7 (HIGH) and a CVSS v3.1 score of 8.8 (HIGH). The CVSS v3.1 vector string is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that the vulnerability can be exploited remotely with low attack complexity, requires low privileges, and no user interaction. The vulnerability allows authenticated attackers to compromise webservers through the creation and execution of webshells (CISA KEV, Commvault Advisory).

The vulnerability affects Commvault's Microsoft Azure environment and has impacted a small number of shared customers between Commvault and Microsoft. However, Commvault has confirmed that there has been no unauthorized access to customer backup data and no material impact on their business operations or ability to deliver products and services (Hacker News, Commvault Update).

Commvault has released patches for all affected versions: 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for both Windows and Linux platforms. Organizations are advised to apply Conditional Access policies to all Microsoft 365, Dynamics 365, and Azure AD single-tenant app registrations, rotate and sync client secrets between Azure portal and Commvault every 90 days, and monitor sign-in activity for suspicious access attempts. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, requiring federal agencies to apply patches by May 19, 2025 (CISA Alert, Commvault Advisory).

The incident has drawn significant attention from the cybersecurity community, particularly due to its exploitation by a nation-state actor. Commvault has been transparent about the breach, working closely with cybersecurity firms, the FBI, and CISA. The company has maintained regular communication through blog updates and security advisories, emphasizing their commitment to customer security and threat intelligence sharing (Commvault Update, Hacker News).