Dashboard / CVE-2025-3928

CVE-2025-3928

CISA KEV
ACT NOW Priority: 0.00 BB Relevance: 1/100
Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.

CISA Known Exploited Vulnerability

Vendor / Product Commvault — Web Server
Date Added 2025-04-28
Remediation Due 2025-05-19
https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html; https://www.commvault.com/blogs/notice-security-advisory-update; https://nvd.nist.gov/vuln/detail/CVE-2025-3928

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
commvault commvault 11.20.0 – 11.20.217
commvault commvault 11.28.0 – 11.28.141
commvault commvault 11.32.0 – 11.32.89
commvault commvault 11.36.0 – 11.36.46

References & Advisories (8)

Bug Bounty Relevance

1 / 100
✓ Known exploited (KEV)

CVSS Score

Unscored

EPSS — Exploitation Probability

2.53%
Raw Score 0.025270
Percentile 84.8%
Date 2026-10-28

Intelligence Sources

kev ref →

External Links