CVE-2025-3928: Commvault Web Server webshell upload by authenticated attacker

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw allows authenticated remote code execution on backup infrastructure and is confirmed exploited in CISA KEV, though it requires valid credentials and the record lacks root-cause detail.

What it is

Commvault Web Server contains an unspecified vulnerability that a remote, authenticated attacker can use to create and execute webshells on the server. Because it allows code execution on a backup infrastructure component, it matters for defenders protecting backup and recovery systems. The record does not describe the underlying root cause, so the exact flaw type is unknown.

Impact

An attacker with valid credentials gains remote code execution on the Commvault Web Server, enabling persistent webshell access and further compromise of the host and connected backup environment.

Attack surface

Reachable over the network via the Commvault Web Server; the CVSS vector indicates network access with low attack complexity and low privileges required, and no user interaction. Authentication is required, so a valid account is a prerequisite.

Exploitation

Listed in CISA KEV since 2025-04-28, confirming exploitation in the wild; EPSS 30-day probability is 0.0214 (81st percentile). No ransomware campaign use is recorded.

What to do

• Upgrade to fixed versions 11.36.46, 11.32.89, 11.28.141, or 11.20.217 for Windows and Linux as applicable.
• Follow the vendor advisory and CISA BOD 22-01 required actions, including discontinuing use if mitigations are unavailable.
• Restrict and audit access to the Commvault Web Server, limiting it to trusted networks and accounts.
• Review and rotate credentials for Commvault administrative and service accounts.
• Monitor for unexpected files or scripts written to web-accessible directories on Commvault servers.

Detection

• Hunt for newly created or modified files in Commvault web server directories, especially script or webshell-like files.
• Alert on suspicious child processes spawned by the Commvault web server process.
• Monitor authentication logs for anomalous or unexpected logins to the Commvault Web Server.
• Review web server logs for unusual POST requests or requests to newly created script paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.