Is CVE-2025-3928 actively exploited?

Yes. KEV Intelligence tracks CVE-2025-3928 as a known exploited vulnerability. Confidence is confirmed.

What exploitation activity has KEV Intelligence observed?

KEV Intelligence has not yet recorded sensor-observed exploitation attempts for CVE-2025-3928. Our sensors continue to monitor for activity targeting this CVE.

Which versions are affected?

CVE-2025-3928 affects Commvault Web Server. KEV Intelligence lists 8 version rows; examples include 11.36.0 to < 11.36.46, 11.36.46, and 11.32.0 to < 11.32.89.

Yes. CVE-2025-3928 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. KEV Intelligence attested it 398 days ahead of CISA.

CVE-2025-3928 Exploited in the Wild — Web Server

Q: What is CVE-2025-3928?

CVE-2025-3928 is Commvault Web Server unspecified vulnerability.

Q: How should organizations remediate it?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Q: Is it in CISA KEV?

Yes. CVE-2025-3928 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. KEV Intelligence attested it 398 days ahead of CISA.

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2025-3928 is Commvault Web Server unspecified vulnerability.

Is it exploited?

Yes. KEV Intelligence tracks this CVE as a known exploited vulnerability. Confidence is confirmed.

Who is affected?

Commvault / Web Server affected before 11.36.46.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms.

This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.

Vendor Product Affected Status

Commvault Web Server Before 11.36.46 Affected

Commvault Web Server 11.36.46 Unaffected

Commvault Web Server Before 11.32.89 Affected

Commvault Web Server 11.32.89 Unaffected

Commvault Web Server Before 11.28.141 Affected

Commvault Web Server 11.28.141 Unaffected

Commvault Web Server Before 11.20.217 Affected

Commvault Web Server 11.20.217 Unaffected

Published: 25 Apr 2025
Exploitation Reported: 28 Apr 2025
Attack vector: Remote
Complexity: Low
Privileges: Low
User interaction: None

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2025-3928
url documentation.commvault.com · CVE Record https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html
url cisa.gov · CVE Record https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_a...
url commvault.com · CVE Record https://www.commvault.com/blogs/security-advisory-march-7-2025
url commvault.com · CVE Record https://www.commvault.com/blogs/notice-security-advisory-update

Exploitation evidence

Why KEV Intelligence marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

CISA

Recorded 28 Apr 2025

Independent exploitation attestation added to the KEV Intelligence record.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the KEV Intelligence Pro API.

Learn about Pro API access

Source	Added
CVE First	2025-04-30 15:36 UTC
CISA	2026-06-02 14:08 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets: 0
User-Agents: 0

Raw values available in Pro and Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No KEV Intelligence virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v4.0

8.7 High

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS

2.1%

Recent mention · TheHackerNews

Commvault Confirms Hackers Exploited CVE-2025-3928 as Zero-Day in Azure Breach

Enterprise data backup platform Commvault has revealed that an unknown nation-state threat actor breached its Microsoft Azure environment by exploiting CVE-2025-3928 but emphasized there is no evidence of unauthorized data access. "This activity has affected a small number of...

Read full advisory

All CVSS Scores

CVSS v4.0 8.7 High

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS v3.1 8.8 High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

All Mentions

Recent mention · TheHackerNews

Commvault Confirms Hackers Exploited CVE-2025-3928 as Zero-Day in Azure Breach

TheHackerNews · 01 May 2025

Enterprise data backup platform Commvault has revealed that an unknown nation-state threat actor breached its Microsoft Azure environment by exploiting CVE-2025-3928 but emphasized there is no evidence of unauthorized data access. "This activity has affected a small number of customers we have in common with Microsoft, and we are working with those customers to provide assistance," the company

Recent mention · All CISA Advisories

CISA Adds Three Known Exploited Vulnerabilities to Catalog

All CISA Advisories · 28 Apr 2025

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-1976 Broadcom Brocade Fabric OS Code Injection Vulnerability CVE-2025-42599 Qualitia Active! Mail Stack-Based Buffer Overflow Vulnerability CVE-2025-3928 Commvault Web Server Unspecified Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited...

Timeline

From disclosure to observed exploitation

02 Jun 2026
Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
30 Apr 2025
Added to KEV Intelligence KEV Feed

High-confidence, third-party attested exploitation
25 Apr 2025
CVE published

Vulnerability disclosed publicly
24 Apr 2025
CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro pricing Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2025-3928

Free JSON includes basic KEV fields

{
  "cve_id": "CVE-2025-3928",
  "confidence": "Confirmed",
  "cvss_score": 8.7,
  "cvss_estimated": false,
  "epss_score": 0.02089,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}

CVE-2025-3928

What security teams need to know first

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker

Tags

CVE References

Why KEV Intelligence marks this CVE as exploited

Exploited in the wild

Known exploited vulnerability sources

Operational artifacts and observed signals

Observed signals

Scanner coverage

Virtual patch status

Severity, weaknesses, and research context

Commvault Confirms Hackers Exploited CVE-2025-3928 as Zero-Day in Azure Breach

All CVSS Scores

All Mentions

From disclosure to observed exploitation

Added to CISA KEV

Added to KEV Intelligence KEV Feed

CVE published

CVE ID reserved

Automate this intelligence

Get alerts on high-impact exploitation