CVE-2025-3928Commvault Web Server zero-day that exposed Metallic Microsoft 365 app secrets

What broke

Commvault's advisory CV_2025_03_1, issued February 24, 2025, says web servers "can be compromised through bad actors creating and executing webshells." Exploitation needs valid user credentials; the advisory states unauthenticated access is not exploitable. Fixed releases are 11.36.46, 11.32.89, 11.28.141 and 11.20.217 on Windows and Linux, and Commvault patched its SaaS service itself. The CVE ID was assigned on April 25, 2025. NVD scores it CVSS 3.1 8.8; the CNA maps it to CWE-94 while NVD lists no CWE. CISA added it to KEV on April 28, 2025.

The identity part is where it was used. Commvault said Microsoft notified it on February 20, 2025 of unauthorized activity by a suspected nation-state actor in Commvault's Azure environment, and that the actor had exploited a zero-day. In May 2025 Commvault said the actor may have accessed "a subset of app credentials that certain Commvault customers use to authenticate their M365 environments." CISA said the actor likely accessed client secrets for the Metallic Microsoft 365 backup SaaS.

Why it matters

A backup service for Microsoft 365 needs an app registration with broad read access to every mailbox and site it protects. The vendor held those client secrets for many tenants in one place, so one web server flaw in the vendor's cloud put a path into customer tenants within reach. The customer's own users, passwords and MFA were not part of that path: the service principal authenticates with a secret, and whoever holds the secret is the app. See the breach database record.

What to do

• Upgrade self-hosted Commvault to a fixed maintenance release.
• Rotate the client secrets of Commvault's Microsoft 365, Dynamics 365 and Microsoft Entra ID app registrations and sync them back to Commvault. Commvault recommends doing this every 90 days.
• Apply a Conditional Access policy to those single-tenant app registrations, as Commvault advises, so they can only sign in from the address ranges you allow.
• Review service principal sign-in logs for those apps and investigate any sign-in from outside those ranges.

After you patch

• Inventory every third-party backup, archiving or security app with tenant-wide read permissions and ask how its vendor stores the secret. Prefer certificate credentials or federated credentials over client secrets where the vendor supports them.

Sources

• NVD: CVE-2025-3928
• Commvault security advisory CV_2025_03_1
• Commvault: Notice, Security Advisory (March 7, 2025)
• Commvault: Notice, Security Advisory Update (May 4, 2025)
• CISA: Advisory update on threat activity targeting Commvault's SaaS cloud application (Metallic)
• CISA Known Exploited Vulnerabilities catalog, added April 28, 2025