Exploited vulnerabilitiesBriefPublic record
Commvault Command Center RCE (CVE-2025-34028) and the Metallic/Azure webshell (CVE-2025-3928)
KEV: CVE-2025-3928 on 28 Apr 2025. CVE-2025-34028 on 2 May 2025.
- Disclosed
What happened
- CISA advisory, 22 May 2025: SaaS client-secret theft from Commvault’s Azure environment, which hit M365 backups.
Live scores
Live scores
CVE-2025-3928- EPSS
- 0.025
some chance of attack soon - VEDAS
- 0.742
some exploit evidence - On CISA KEV
- Yes, since 2025-04-28
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Live scores
CVE-2025-34028- EPSS
- 0.976
very likely to be attacked soon - VEDAS
- 0.987
strong exploit evidence - On CISA KEV
- Yes, since 2025-05-02
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Sources
- https://www.cisa.gov/news-events/news/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic
- https://nvd.nist.gov/vuln/detail/CVE-2025-34028
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.