erroneo.us
Search all guides⌘K

Security Digest · Feb 24, 2025 · Vulnerability · Other

Commvault CVE-2025-3928: Web Server Zero-Day in Azure

Authenticated webshell flaw in Commvault Web Server, used as a zero-day by a nation-state actor in Commvault's Azure. Fixed in 11.36.46 and others. Verify.

Published By erroneo.us Security Desk · Updated 3 min read10 sources

Our verdict

Check exposure

Patched since February 2025 and auto-fixed for SaaS; confirm on-prem Commvault web components run a fixed build, and that Metallic Microsoft 365 app secrets were rotated and Entra logs reviewed.

Who must act: Customers running Commvault CommServe, Web Server or Command Center on 11.20, 11.28, 11.32 or 11.36 below the fixed builds, and Metallic Microsoft 365 backup customers who manage their own Entra app secrets.

Who can relax: Commvault SaaS customers who rotated M365 app secrets in 2025 and found no suspicious sign-ins, and on-prem customers who have stayed on current maintenance releases.

Affected
Commvault 11.36.0 to 11.36.45
Commvault 11.32.0 to 11.32.88
Commvault 11.28.0 to 11.28.140
Commvault 11.20.0 to 11.20.216
Fixed in
Commvault 11.36.46
Commvault 11.32.89
Commvault 11.28.141
Commvault 11.20.217
Commvault SaaS patched automatically
CVSS
8.7 (v4.0, CNA)
EPSS
2.5% (percentile 84)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Confirm the maintenance release on every CommServe, Web Server and Command Center host is at or above the fixed build for its line.
  2. Restrict Commvault management and web interfaces to trusted admin networks; remove internet exposure.
  3. Metallic M365 customers: rotate the Entra app secrets used by Commvault, especially service principals created between February and May 2025.
  4. Apply a Conditional Access policy that limits Commvault single-tenant service principals to Commvault's published IP ranges.
  5. Review Entra app registrations used by Commvault and trim permissions to what backup needs.

How to check if you are affected or compromised

  • Search Entra sign-in and service principal sign-in logs for 108.69.148.100, 128.92.80.210, 184.153.42.129, 108.6.189.53 and 159.242.42.20.
  • Review Entra audit logs for new credentials or changes on Commvault-related service principals and for sign-ins outside Commvault's allowlisted ranges.
  • On on-prem Commvault web servers, look for unexpected new files in web-accessible directories and for unusual processes spawned by the web server.

What happened#

On February 20, 2025, Microsoft told Commvault it had seen a suspected nation-state actor inside Commvault's Azure environment. Commvault's investigation found the actor had used a zero-day in the Commvault Web Server. On February 24, Commvault issued advisory CV_2025_03_1, which says "webservers can be compromised through bad actors creating and executing webshells." Exploitation requires valid Commvault user credentials. The flaw is not exploitable without authentication. CISA, acting as CNA, published CVE-2025-3928 on April 25 (CVSS 4.0 8.7, CVSS 3.1 8.8). It added the flaw to the KEV catalog on April 28, 2025.

The target was not backup data. Commvault said in its customer update that the actor may have accessed "a subset of app credentials" that customers use to authenticate their Microsoft 365 environments to Commvault's Metallic backup service. It said backup data was not accessed. Its March 7 notice put the number affected at "a handful of customers." On May 22, CISA warned that this may be part of a larger campaign. The targets, it said, were SaaS companies' cloud applications with default configurations and elevated permissions.

Who is affected#

The vulnerable component is the web server tier. That covers CommServe, Web Server and Command Center on Linux and Windows; client computers are not affected. The fixed builds are 11.36.46, 11.32.89, 11.28.141 and 11.20.217. Commvault SaaS was patched automatically. A second group matters as much: Metallic Microsoft 365 backup customers whose Entra app secrets were stored in Commvault's Azure environment.

Do you really need to act?#

For most customers, this is a one-time check. The on-prem fix has been out since February 2025, and the bug needs a valid login. Neither Commvault nor CISA has named the nation-state actor, and The Record notes that Microsoft did not answer questions about attribution. The harder question is your Microsoft 365 tenant. A stolen client secret keeps working until it is rotated or expires. If you never rotated Commvault's M365 app secrets after spring 2025, or never reviewed the related sign-ins, do that now.

What to do now#

  1. Check the maintenance release on each CommServe, Web Server and Command Center host. Upgrade anything below the fixed build for its line, and prefer a current supported release.
  2. Restrict Commvault management interfaces to admin networks. CISA also recommends a WAF in front of any web-facing component.
  3. Rotate the Entra client secrets Commvault uses, prioritizing service principals created between February and May 2025. Commvault suggests rotating every 90 days; CISA suggests 30 where possible.
  4. For single-tenant apps, add a Conditional Access policy that limits Commvault service principals to Commvault's allowlisted IPs. This requires an Entra Workload ID Premium license.
  5. List the apps with Get-MgServicePrincipal -All | Where-Object DisplayName -match 'Commvault|Metallic' and remove permissions backup does not need.

How to tell if you were hit#

Commvault published five IP addresses, reported by The Hacker News: 108.69.148.100, 128.92.80.210, 184.153.42.129, 108.6.189.53 and 159.242.42.20. In Sentinel or Log Analytics, query AADServicePrincipalSignInLogs and SigninLogs for those addresses, going back as far as your retention allows. Review Entra audit logs for new credentials added to Commvault service principals and for sign-ins from outside Commvault's ranges. On on-prem web servers, CISA advises watching for activity from unexpected, web-accessible directories, which is where a webshell would live.

Timeline#

  • — Microsoft notifies Commvault of the Azure intrusion.
  • — Commvault issues CV_2025_03_1 with fixed builds.
  • — Commvault discloses the zero-day; further web server fixes are added.
  • — CVE-2025-3928 is published.
  • — CISA adds it to KEV, with a due date of May 19.
  • — Commvault says M365 app credentials may have been accessed.
  • — CISA links the activity to a wider SaaS campaign.

Vulnerability records

  • CVE-2025-3928 · KEV 2025-04-28 · Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Commvault — CV_2025_03_1: Critical Webserver Vulnerability documentation.commvault.com
  2. CVE record — CVE-2025-3928 cve.org
  3. NVD — CVE-2025-3928 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2025-3928 cisa.gov
  5. CISA — Advisory update on cyber threat activity targeting Commvault's SaaS cloud application (Metallic) cisa.gov
  6. Commvault — Security advisory, March 7, 2025 commvault.com
  7. Commvault — Customer security update commvault.com

Coverage and analysis

  1. The Hacker News — Commvault confirms hackers exploited CVE-2025-3928 as zero-day in Azure breach thehackernews.com
  2. SecurityWeek — More details come to light on Commvault vulnerability exploitation securityweek.com
  3. The Record — Commvault clients should beware of campaign targeting cloud applications, CISA says therecord.media