CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: May 19, 2025

High

CISA KEV

CVE-2025-3928

Commvault—Web Server

Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.

Required Action

https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html; https://www.commvault.com/blogs/notice-security-advisory-update; https://nvd.nist.gov/vuln/detail/CVE-2025-3928

Vulnerability Overview

Severity: High
CISA KEV: Yes
Ransomware: Unknown
Published: Apr 28, 2025
KEV Added: Apr 28, 2025
Due Date: May 19, 2025
Related Articles: 0

Vendor

Commvault

Web Server