DaystoPatch

CommvaultExploited incident

Commvault Web Server webshell vulnerability (CV_2025_03_1)

CVE-2025-3928High, CVSS 8.8In CISA's Known Exploited Vulnerabilities catalog since 28 Apr 2025

  • Exploited before a fix
FixedFixed for every supported version 14 days after the first public report.

Response

Silence
same day
First public report to first vendor statement
Exposure
11d
First public report to first fix
Follow-through
14d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Commvault security advisory CV_2025_03_1 (Wayback snapshot 2025-03-10)CuratedQuote verified

    A vulnerability has been identified and remediated in all supported versions of the Commvault software. Webservers can be compromised through bad actors creating and executing webshells.

    Advisory 'Issued: 2025-02-24' (no CVE ID until 2025-04-25). First public signal of the bug; it did not mention exploitation.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0f32a05ea4ee99a4…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    Commvault blog: Notice: Security Advisory (Danielle Sheer, March 7, 2025)CuratedQuote verified7 Mar 2025

    Our forensic investigation discovered that the threat actor exploited a zero-day vulnerability, which has been patched and we encourage our software customers to do the same.

    First public statement of exploitation. Same post: 'On February 20, 2025, Microsoft notified us about unauthorized activity within our Azure environment by a suspected nation-state threat actor.'

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5327db971de75e4f…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-3928ClaimedQuote verified25 Apr 2025, 15:56 UTC

    Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:2b3912d16bf9629c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet25 Apr 2025, 17:10 UTC

    You can now share your thoughts on vulnerability CVE-2025-3928 in Vulnerability-Lookup:

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet26 Apr 2025, 04:45 UTC

    CVE Alert: CVE-2025-3928 - https://www. redpacketsecurity.com/cve_aler t_cve-2025-3928/ # OSINT # ThreatIntel # CyberSecurity # cve_2025_3928

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-3928)ClaimedQuote verified28 Apr 2025

    Commvault Web Server Unspecified Vulnerability

    Added to CISA's KEV catalog on 2025-04-28.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Commvault security advisory CV_2025_03_1 (Wayback snapshot 2025-03-10)CuratedQuote verified

    Issued: 2025-02-24

    Re-sourced to a Wayback snapshot because documentation.commvault.com disallows automated fetching (robots.txt).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0f32a05ea4ee99a4…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date only+11d

    Commvault security advisory CV_2025_03_1, update of March 7, 2025 (Wayback snapshot 2025-03-10)CuratedQuote verified

    UPDATE (March 7th, 2025) – We have implemented additional fixes to enhance the security of the webserver module.

    R1: Commvault added fixes after the 2025-02-24 issue, and its fixed-versions table (snapshot 'Updated: 2025-03-07') lists 11.36.46, 11.32.88/89, 11.28.141 and 11.20.217 as the resolved versions, with earlier builds affected. Commvault's documentation index lists 'Maintenance Release 11.36.46 (Mar 07, 2025)' (search-indexed page, no longer online and not archived), consistent with the fixed builds shipping on 2025-03-07. Upper bound for the other lines: fixed builds may have shipped earlier.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:9c83a85d8e7a8841…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date only+14d

    Commvault security advisory CV_2025_03_1 (Wayback snapshot 2025-03-27)CuratedQuote verified

    UPDATE (March 10th, 2025) – Version 11.32.88 had issues with loading certain reports correctly. These issues have been resolved in version 11.32.89.

    The advisory's fixed-versions table now lists '11.32.0 - 11.32.88' as affected and '11.32.89 and higher' as resolved, so under R1/R6 the 11.32 line's fix is 11.32.89 (2025-03-10), the last of the four lines.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:9d27f09ebb16bd29…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. CV_2025_03_1

    Recorded in the revision history

    CV_2025_03_1: Critical Webserver Vulnerability HIGH

    Version table: 1 row added and 1 row removed. One new row reads "Commvault | Linux, Windows | 11.32.0 - 11.32.88 | 11.32.89 | Resolved".

    • Fixed versions
    Version table rows
    BeforeCommvault | Linux, Windows | 11.32.0 - 11.32.87 | 11.32.88 | Resolved
    AfterCommvault | Linux, Windows | 11.32.0 - 11.32.88 | 11.32.89 | Resolved
    Verbatim wording. Removed text is struck through. Added text is bold.
    Before

    ed Products Product | Platforms | Affected Versions | Resolved Version | Status Commvault | Linux, Windows | 11.36.0 - 11.36.45 | 11.36.46 | Resolved Commvault | Linux, Windows | 11.32.0 - 11.32.87 | 11.32.88 | Resolved Commvault | Linux, Windows | 11.28.0 - 11.28.140 | 11.28.141 | Resolved Commvault | Linux, Windows | 11.20.0 - 11.20.216 | 11.20.217 | Resolved Resolution To prevent this issue, im

    After

    ed Products Product | Platforms | Affected Versions | Resolved Version | Status Commvault | Linux, Windows | 11.36.0 - 11.36.45 | 11.36.46 | Resolved Commvault | Linux, Windows | 11.32.0 - 11.32.88 | 11.32.89 | Resolved Commvault | Linux, Windows | 11.28.0 - 11.28.140 | 11.28.141 | Resolved Commvault | Linux, Windows | 11.20.0 - 11.20.216 | 11.20.217 | Resolved Resolution To prevent this issue, im

    Earlier version captured 10 Mar 2025, 05:20 UTC: archived copyLater version captured 27 Mar 2025, 13:45 UTC: archived copyRecovered from archived copiesSnapshots 48906bf11d… and c30e9002f1…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Commvault software (CommServe, Web Server, Command Center) 11.20, 11.28, 11.32, 11.36 on Linux and Windows
  • Commvault SaaS (Metallic)
How we built this timeline

AUDIT 2 (23 Oct 2026, T1/R1): First fix moved 24 Feb 2025 -> 7 Mar 2025. The advisory was issued 24 Feb 2025 claiming the bug was 'remediated in all supported versions', but Commvault then 'implemented additional fixes' on 7 Mar 2025, and the resolved versions in its final table (11.36.46 etc.) appear to be the March 7 maintenance releases (11.32.89 followed on 10 Mar 2025).

Under R1 the 24 Feb 2025 state is not counted as the complete fix. exploited before a fix=true under R4, independent of the exact build date: Commvault says Microsoft notified it on 20 Feb 2025 of nation-state activity in its Azure environment and that 'the threat actor exploited a zero-day vulnerability' (blog, 7 Mar 2025), i.e. exploitation began before any fix. Earlier correction pass: Fixed for all versions moved to 10 Mar 2025 (11.32.89;

R1/R6); Vendor statement moment re-sourced to Wayback (robots.txt).

Commvault's 27 Apr 2025 update says the activity affected 'a small number of customers we have in common with Microsoft'. Exploitation requires authenticated credentials in an internet-accessible environment.

CVSS 8.8 is Commvault's CNA CVSS 3.1 score.

Related

No related incidents.

Commvault report card