Commvault Web Server unspecified vulnerability
Priority CRITICAL 97Exploited in the wildCWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.
Why it matters now
Exploitation Active In CISA KEV since 2025-04-28CISA due date 2025-05-19
EPSS 0.02527 84th percentileScored 2026-11-07
Fix Fixed Web Server (Commvault): 11.36.46, 11.32.89, 11.28.141 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Commvault | Web Server | 11.36.0 to before 11.36.46; 11.32.0 to before 11.32.89; 11.28.0 to before 11.28.141; 11.20.0 to before 11.20.217 | 11.36.46, 11.32.89, 11.28.141, 11.20.217 | Patch available | CNA |
- Web Server VendorCommvault Affected 11.36.0 to before 11.36.46; 11.32.0 to before 11.32.89; 11.28.0 to before 11.28.141; 11.20.0 to before 11.20.217 Fixed in 11.36.46, 11.32.89, 11.28.141, 11.20.217 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:* | 11.20.0 to before 11.20.217; 11.28.0 to before 11.28.141; 11.32.0 to before 11.32.89; 11.36.0 to before 11.36.46 | Vulnerable | Commvault |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:* Versions 11.20.0 to before 11.20.217; 11.28.0 to before 11.28.141; 11.32.0 to before 11.32.89; 11.36.0 to before 11.36.46 Vulnerable ·Commvault
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA Web Server (Commvault) Fixed in 11.36.46, 11.32.89, 11.28.141, 11.20.217
Timeline
- 2025-04-28 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2025-3928
- 2026-10-03 Alias added: GHSA-wqxv-v2vg-q37x
- 2026-10-07 Weakness changed · CISA ADP
References
More Commvault vulnerabilities
- TI-2025-24197 Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal KEVCVSS 4.0CRITICAL 9.3
- TI-2017-13252 A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault… CVSS 3.0CRITICAL 9.8
- TI-2025-35673 Path traversal in Commvault CommCell CVSS 4.0HIGH 8.7
- TI-2025-35674 Argument Injection Vulnerability in CommServe CVSS 4.0MEDIUM 6.9
- TI-2026-53842 Command Center API Authentication Bypass CVSS 4.0CRITICAL 9.3
- TI-2025-35671 Unauthorized API Access Risk CVSS 4.0MEDIUM 6.9
Sources
- CVE-2025-3928 · CVE Program
- CVE-2025-3928 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-wqxv-v2vg-q37x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences