CVE-2025-3928

What it actually does

This vulnerability allows a remote, authenticated attacker to compromise the Commvault Web Server by creating and executing web shells. Although the vendor has not publicly specified the underlying bug class, the practical impact is authenticated remote code execution within the security context of the Commvault web service. Successful exploitation can allow arbitrary command execution, persistence through uploaded or generated web-accessible scripts, access to backup-management functions, and potential movement into systems reachable from the Commvault infrastructure.

Why it matters to the business

Compromise of a Commvault Web Server is high impact because backup platforms commonly hold administrative access, sensitive backup data, credentials, and recovery workflows. An attacker who gains code execution may tamper with backups, steal protected data, disrupt restore capability, or use the server as a foothold for broader intrusion. This issue is confirmed exploited in the wild and is listed in CISA’s Known Exploited Vulnerabilities catalog with a remediation deadline of 2025-05-19, so unpatched systems should be treated as urgent exposure even though the EPSS score is relatively low.

How an attack unfolds

An attacker first obtains valid authentication to the Commvault Web Server, either through stolen credentials, reused passwords, phishing, exposed administrative accounts, or prior compromise. After logging in, the attacker abuses the vulnerability to create a web shell on the Commvault web server. The attacker then accesses the web shell over HTTP or HTTPS to execute operating-system commands remotely. From there, they may enumerate the host, collect configuration files and credentials, inspect backup jobs and stored data, stage additional tooling, establish persistence, and attempt lateral movement into adjacent infrastructure. Because this vulnerability has been observed in active exploitation, defenders should assume that exposed, unpatched, internet-reachable Commvault Web Servers may already have been targeted.

How to fix it

Upgrade Commvault to a fixed release immediately. The vendor-fixed versions are 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. If immediate upgrade is not possible, restrict Commvault Web Server access to trusted administrative networks or VPNs, remove internet exposure, enforce multi-factor authentication for administrative access, rotate credentials that can authenticate to Commvault, and monitor for web shell artifacts. Because exploitation creates and executes web shells, mitigation should not be considered complete until the system has been inspected for compromise and any suspicious files, accounts, scheduled tasks, services, or processes have been removed.

How to confirm the fix worked

Confirm the installed Commvault version is one of the fixed releases or later: 11.36.46, 11.32.89, 11.28.141, or 11.20.217 depending on the deployed branch. Verify that the Commvault Web Server is not directly reachable from untrusted networks unless explicitly required and protected by strong access controls. Review web server directories for recently created or modified executable scripts and compare against a known-good baseline from the installed Commvault release. Test authentication controls, MFA enforcement, and administrative access restrictions. After patching, confirm that previously suspicious web shell URLs no longer execute and that no unauthorized persistence remains on the host.

Typical attack path

1. Identify an exposed Commvault Web Server instance.
2. Authenticate to the Commvault Web Server using valid or compromised credentials.
3. Trigger the vulnerable functionality to create a malicious web shell on the server.
4. Send HTTP or HTTPS requests to the web shell to execute commands.
5. Enumerate the Commvault host, service account privileges, configuration, backup repositories, and network reachability.
6. Collect credentials, tokens, configuration files, logs, or backup metadata available to the web server process.
7. Deploy additional payloads or persistence mechanisms.
8. Use the compromised backup server as a foothold for data theft, backup tampering, or lateral movement.

How to detect it

Review Commvault Web Server, web access, application, authentication, EDR, and operating-system logs for signs of authenticated users creating or accessing unusual web-accessible scripts. Focus on requests that result in script execution, especially newly created files with extensions such as .jsp, .jspx, .asp, .aspx, .php, .war, .cmd, .bat, .ps1, .sh, or files with random names in web server directories. Look for web server or Commvault service processes spawning command interpreters or scripting engines, including cmd.exe, powershell.exe, wscript.exe, cscript.exe, bash, sh, python, perl, curl, wget, certutil, or nc. Investigate anomalous successful logins, especially from unfamiliar IP addresses, impossible travel, off-hours administrative sessions, repeated failed logins followed by success, or newly created administrative accounts. On Windows, inspect Event IDs 4688 for suspicious process creation, 4624 for logons, 4625 for failed logons, 4698 for scheduled task creation, 7045 for new service installation, and PowerShell logs such as 4104. On Linux, review web server logs, shell history where available, auth logs, cron directories, systemd service changes, and file modification timestamps. Because this CVE is known exploited, also examine backup job history and audit logs for unauthorized deletion, disabling, export, restore, or credential-management activity.

• web server process spawning cmd.exe
• web server process spawning powershell.exe
• web server process spawning /bin/sh
• web server process spawning /bin/bash
• web server process spawning python
• web server process spawning perl
• web server process spawning curl
• web server process spawning wget
• web server process spawning certutil.exe
• web server process spawning nc
• *.jsp created in a web-accessible directory
• *.jspx created in a web-accessible directory
• *.asp created in a web-accessible directory
• *.aspx created in a web-accessible directory
• *.php created in a web-accessible directory
• *.war created in a web-accessible directory
• *.cmd created in a web-accessible directory
• *.bat created in a web-accessible directory
• *.ps1 created in a web-accessible directory
• *.sh created in a web-accessible directory
• Event ID 4688 cmd.exe /c
• Event ID 4688 powershell.exe -enc
• Event ID 4688 powershell.exe -EncodedCommand
• Event ID 7045
• Event ID 4698
• Event ID 4104
• /bin/sh -c
• /bin/bash -c
• curl http
• wget http
• certutil -urlcache
• certutil -decode
• whoami
• ipconfig /all
• ifconfig
• net user
• net localgroup administrators
• chmod +x
• crontab -e

What your security team should do

• Patch or upgrade all Commvault Web Server deployments to a fixed version immediately, prioritizing internet-facing and externally reachable systems.
• Treat unpatched systems as potentially compromised because the vulnerability is in the CISA KEV catalog and exploitation is active in the wild.
• Perform incident-response triage on affected servers before and after patching, focusing on web shell creation, suspicious child processes, abnormal authentication, and unauthorized administrative activity.
• Restrict Commvault Web Server access to trusted administrative networks and require MFA for all privileged accounts.
• Rotate Commvault administrative credentials, service account credentials, API tokens, and any secrets stored or accessible on potentially affected servers.
• Review backup integrity, restore points, retention settings, and job history for unauthorized deletion, encryption, alteration, or exfiltration activity.
• Add detections for unusual script files in Commvault web directories and web server processes spawning command shells or scripting interpreters.
• Preserve relevant web, application, authentication, EDR, and operating-system logs for forensic review, especially around the period before patching.