---
title: "Commvault CVE-2025-3928: Web Server Zero-Day in Azure"
url: https://erroneo.us/security/briefs/commvault-cve-2025-3928-web-server-webshell/
description: "Authenticated webshell flaw in Commvault Web Server, used as a zero-day by a nation-state actor in Commvault's Azure. Fixed in 11.36.46 and others. Verify."
type: security-brief
section: "Security Digest"
date_published: 2025-02-24
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-3928"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Commvault CVE-2025-3928: Web Server Zero-Day in Azure

**Verdict: Check exposure.** Patched since February 2025 and auto-fixed for SaaS; confirm on-prem Commvault web components run a fixed build, and that Metallic Microsoft 365 app secrets were rotated and Entra logs reviewed.

- **Who must act:** Customers running Commvault CommServe, Web Server or Command Center on 11.20, 11.28, 11.32 or 11.36 below the fixed builds, and Metallic Microsoft 365 backup customers who manage their own Entra app secrets.
- **Who can relax:** Commvault SaaS customers who rotated M365 app secrets in 2025 and found no suspicious sign-ins, and on-prem customers who have stayed on current maintenance releases.
- **Affected:** Commvault 11.36.0 to 11.36.45; Commvault 11.32.0 to 11.32.88; Commvault 11.28.0 to 11.28.140; Commvault 11.20.0 to 11.20.216
- **Fixed:** Commvault 11.36.46; Commvault 11.32.89; Commvault 11.28.141; Commvault 11.20.217; Commvault SaaS patched automatically
- **CVEs:** CVE-2025-3928
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Confirm the maintenance release on every CommServe, Web Server and Command Center host is at or above the fixed build for its line.
2. Restrict Commvault management and web interfaces to trusted admin networks; remove internet exposure.
3. Metallic M365 customers: rotate the Entra app secrets used by Commvault, especially service principals created between February and May 2025.
4. Apply a Conditional Access policy that limits Commvault single-tenant service principals to Commvault's published IP ranges.
5. Review Entra app registrations used by Commvault and trim permissions to what backup needs.

### How to check if you are affected

- Search Entra sign-in and service principal sign-in logs for 108.69.148.100, 128.92.80.210, 184.153.42.129, 108.6.189.53 and 159.242.42.20.
- Review Entra audit logs for new credentials or changes on Commvault-related service principals and for sign-ins outside Commvault's allowlisted ranges.
- On on-prem Commvault web servers, look for unexpected new files in web-accessible directories and for unusual processes spawned by the web server.

## What happened

On February 20, 2025, Microsoft told Commvault it had seen a suspected nation-state actor inside Commvault's Azure environment. Commvault's investigation found the actor had used a zero-day in the Commvault Web Server. On February 24, Commvault issued advisory [CV_2025_03_1](https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html), which says "webservers can be compromised through bad actors creating and executing webshells." Exploitation requires valid Commvault user credentials. The flaw is not exploitable without authentication. CISA, acting as CNA, published [CVE-2025-3928](https://www.cve.org/CVERecord?id=CVE-2025-3928) on April 25 (CVSS 4.0 8.7, CVSS 3.1 8.8). It added the flaw to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928) on April 28, 2025.

The target was not backup data. Commvault said in its [customer update](https://www.commvault.com/blogs/customer-security-update) that the actor may have accessed "a subset of app credentials" that customers use to authenticate their Microsoft 365 environments to Commvault's Metallic backup service. It said backup data was not accessed. Its March 7 notice put the number affected at "a handful of customers." On May 22, CISA [warned](https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic) that this may be part of a larger campaign. The targets, it said, were SaaS companies' cloud applications with default configurations and elevated permissions.

## Who is affected

The vulnerable component is the web server tier. That covers CommServe, Web Server and Command Center on Linux and Windows; client computers are not affected. The fixed builds are 11.36.46, 11.32.89, 11.28.141 and 11.20.217. Commvault SaaS was patched automatically. A second group matters as much: Metallic Microsoft 365 backup customers whose Entra app secrets were stored in Commvault's Azure environment.

## Do you really need to act?

For most customers, this is a one-time check. The on-prem fix has been out since February 2025, and the bug needs a valid login. Neither Commvault nor CISA has named the nation-state actor, and [The Record](https://therecord.media/commvault-clients-cloud-applications-cyberthreat-cisa-alert) notes that Microsoft did not answer questions about attribution. The harder question is your Microsoft 365 tenant. A stolen client secret keeps working until it is rotated or expires. If you never rotated Commvault's M365 app secrets after spring 2025, or never reviewed the related sign-ins, do that now.

## What to do now

1. Check the maintenance release on each CommServe, Web Server and Command Center host. Upgrade anything below the fixed build for its line, and prefer a current supported release.
2. Restrict Commvault management interfaces to admin networks. CISA also recommends a WAF in front of any web-facing component.
3. Rotate the Entra client secrets Commvault uses, prioritizing service principals created between February and May 2025. Commvault suggests rotating every 90 days; CISA suggests 30 where possible.
4. For single-tenant apps, add a Conditional Access policy that limits Commvault service principals to Commvault's allowlisted IPs. This requires an Entra Workload ID Premium license.
5. List the apps with `Get-MgServicePrincipal -All | Where-Object DisplayName -match 'Commvault|Metallic'` and remove permissions backup does not need.

## How to tell if you were hit

Commvault published five IP addresses, reported by [The Hacker News](https://thehackernews.com/2025/05/commvault-confirms-hackers-exploited.html): `108.69.148.100`, `128.92.80.210`, `184.153.42.129`, `108.6.189.53` and `159.242.42.20`. In Sentinel or Log Analytics, query `AADServicePrincipalSignInLogs` and `SigninLogs` for those addresses, going back as far as your retention allows. Review Entra audit logs for new credentials added to Commvault service principals and for sign-ins from outside Commvault's ranges. On on-prem web servers, CISA advises watching for activity from unexpected, web-accessible directories, which is where a webshell would live.

## Timeline

- Feb 20, 2025 — Microsoft notifies Commvault of the Azure intrusion.
- Feb 24, 2025 — Commvault issues CV_2025_03_1 with fixed builds.
- Mar 7, 2025 — [Commvault discloses](https://www.commvault.com/blogs/security-advisory-march-7-2025) the zero-day; further web server fixes are added.
- Apr 25, 2025 — CVE-2025-3928 is published.
- Apr 28, 2025 — CISA adds it to KEV, with a due date of May 19.
- May 4, 2025 — Commvault says M365 app credentials may have been accessed.
- May 22, 2025 — CISA links the activity to a wider SaaS campaign.

## Sources

1. [Commvault — CV_2025_03_1: Critical Webserver Vulnerability](https://documentation.commvault.com/securityadvisories/CV_2025_03_1.html)
2. [CVE record — CVE-2025-3928](https://www.cve.org/CVERecord?id=CVE-2025-3928)
3. [NVD — CVE-2025-3928](https://nvd.nist.gov/vuln/detail/CVE-2025-3928)
4. [CISA — Known Exploited Vulnerabilities: CVE-2025-3928](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3928)
5. [CISA — Advisory update on cyber threat activity targeting Commvault's SaaS cloud application (Metallic)](https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic)
6. [Commvault — Security advisory, March 7, 2025](https://www.commvault.com/blogs/security-advisory-march-7-2025)
7. [Commvault — Customer security update](https://www.commvault.com/blogs/customer-security-update)
8. [The Hacker News — Commvault confirms hackers exploited CVE-2025-3928 as zero-day in Azure breach](https://thehackernews.com/2025/05/commvault-confirms-hackers-exploited.html)
9. [SecurityWeek — More details come to light on Commvault vulnerability exploitation](https://www.securityweek.com/more-details-come-to-light-on-commvault-vulnerability-exploitation/)
10. [The Record — Commvault clients should beware of campaign targeting cloud applications, CISA says](https://therecord.media/commvault-clients-cloud-applications-cyberthreat-cisa-alert)

---
Source page: https://erroneo.us/security/briefs/commvault-cve-2025-3928-web-server-webshell/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt