Nation-State Actors Are Exploiting Azure-Hosted Commvault Systems via CVE-2025-3928 — Act Now
An advanced, targeted campaign is actively exploiting a newly discovered security flaw—CVE-2025-3928—in Commvault deployments running within Microsoft Azure. Unlike generic vulnerabilities, this one has already been leveraged by a nation-state group and is now officially listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog.
What’s at Stake
CVE-2025-3928 impacts critical components: the Commvault Web Server modules across CommServe, Web Servers, and Command Center installations. It gives attackers—armed with valid credentials—the power to implant and execute webshells, opening the door to persistent backdoors, data manipulation, and lateral movement.
Although exploitation requires authentication, threat actors have been observed using stolen or phished credentials to trigger the vulnerability in real-world attacks.
Commvault confirmed in a recent advisory that while only a handful of customers (overlapping with Microsoft) have been affected so far, active response and support efforts are underway. Investigations are ongoing, and no backup data loss has been reported at this stage.
Proactive Detection: KQL-Based Threat Hunting
Security researcher Steven Lim of KQLWizard has crafted a purpose-built KQL query that leverages Azure Activity and SigninLogs to detect suspicious behaviors linked to this campaign. This approach is especially effective in cloud-first environments using Commvault integrations.
kql
textlet CommVaultIOC = dynamic([“108.69.148.100”, “128.92.80.210”, “184.153.42.129”, “108.6.189.53”, “159.242.42.20”]);
let AzureActivityResult =
AzureActivity
| where TimeGenerated > ago(90d)
| where CallerIpAddress has_any(CommVaultIOC);
SigninLogs
| where TimeGenerated > ago(90d)
| where IPAddress has_any(CommVaultIOC)
| union AzureActivityResult
This script cross-references known malicious IPs—attributed to the ongoing exploitation effort—against recent Azure activity and login events. It’s a rapid, actionable tool to spot infiltration attempts before critical data is exposed.
Immediate Mitigation Steps
All organizations—public or private—must act. CISA requires U.S. federal civilian agencies to patch by May 19, 2025, but any business running Commvault should take the following steps immediately:
🔒 Apply Security Updates
Upgrade to the following patched versions for both Windows and Linux:
- 11.36.46
- 11.32.89
- 11.28.141
- 11.20.217
🚫 Harden Identity Access
- Implement Conditional Access for all Microsoft 365, Dynamics 365, and Azure AD app registrations.
- Enforce 90-day rotation of secrets between Azure and Commvault.
- Explicitly block known attacker IPs in Conditional Access rules.
- Monitor logins for geolocations or devices outside your trusted perimeter.
📣 Report Anomalies
If you detect suspicious behavior, report it to Commvault Support without delay.
Bottom Line: Time Is a Critical Variable
CVE-2025-3928 is more than a patching issue—it’s an active battlefield. Security teams must combine early detection, cloud-native telemetry, and identity controls to defend against ongoing, targeted attacks.
Organizations that move quickly to adopt these protections stand the best chance of keeping their backup systems intact and their cloud ecosystems secure.
