Answer in brief
CVE-2025-3928 records a High severity (CVSS 8.7) vulnerability in Commvault Web Server unspecified vulnerability. The current sources mark it as known exploited. The current feed maps Commvault/Web Server (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.7. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Commvault/Web Server (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:commvault:commvault:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Commvault/Web Servergeneric | >=11.36.0 <11.36.46 || >=11.32.0 <11.32.89 || >=11.28.0 <11.28.141 || >=11.20.0 <11.20.217 | 11.36.46, 11.32.89, 11.28.141, 11.20.217 |
Published upstream
Apr 25, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
May 24, 2026
Added to CISA KEV
Apr 28, 2025
Evidence: source:kev:kev:kev:recordCommvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.
Quoted source text, attributed separately from HOL analysis.