Commvault, the data protection giant, has confirmed that a sophisticated nation-state threat actor exploited a previously unknown vulnerability in its Web Server component to breach its Microsoft Azure environment—and the fallout could ripple across the entire software-as-a-service industry. The flaw, tracked as CVE-2025-3928, earned a coveted spot on CISA’s Known Exploited Vulnerabilities list just days after disclosure, with federal agencies given a hard May 19, 2025 deadline to apply emergency patches. The attack, first detected by Microsoft on February 20, 2025, allowed remote code execution with only low-level authenticated access, threatening the secrets that underpin Commvault’s Metallic Microsoft 365 backup service.

On that February morning, Microsoft’s threat intelligence teams flagged unusual activity inside Commvault’s Azure tenant. The intruders had already moved laterally, hunting for the cryptographic keys that secure the bridge between Metallic and its customers’ Microsoft 365 environments. Commvault’s own investigation, supported by outside cybersecurity firms and law enforcement including the FBI, traced the entry point to a zero-day in the Web Server component that ships with multiple versions of the company’s platform. The flaw received the CVE identifier CVE-2025-3928 on April 28, 2025, the same day CISA elevated it to active exploitation status.

The vulnerable versions span four major release families: 11.36.0 through 11.36.45; 11.32.0 through 11.32.88; 11.28.0 through 11.28.140; and 11.20.0 through 11.20.216. Both Windows and Linux deployments are affected. Commvault immediately published fixes—versions 11.36.46, 11.32.89, 11.28.141, and 11.20.217—and urged every customer to upgrade, regardless of whether they use the Metallic SaaS offering or on-premises installations.

What the Attackers Could Do—and What They Did

CVE-2025-3928 is not a theoretical bug. It enables an authenticated attacker with minimal privileges to execute arbitrary code on the target server. In the context of Commvault’s architecture, that means an adversary who first obtained any valid credential—perhaps through phishing or a prior breach—could leap from a low-privileged account to full system compromise. Once inside, the attackers went straight for the application secrets that Metallic uses to authenticate to customers’ Microsoft 365 tenants. Commvault acknowledged that the threat actors “may have accessed client secrets” for the Metallic Microsoft 365 backup SaaS solution, effectively handing them a skeleton key to any customer environment where those secrets had not been rotated recently.

Importantly, Commvault states there is no evidence that backup data itself was exfiltrated or tampered with. However, the breach window leaves open the possibility that attackers enumerated mailboxes, SharePoint sites, or other M365 resources linked to the compromised secrets. CISA’s advisory notes that the activity may be part of a larger campaign targeting SaaS applications with default configurations and elevated permissions. That suggests the Commvault incident is not an isolated hit, but a template for broader attacks against cloud-to-cloud connectors that many SaaS vendors rely on.

CISA Raises the Alarm, Sets Patch Deadline

The U.S. Cybersecurity and Infrastructure Security Agency wasted no time. On April 28, it added CVE-2025-3928 to the Known Exploited Vulnerabilities (KEV) catalog, a designation reserved for flaws that are actively being weaponized. Federal Civilian Executive Branch agencies must patch by May 19, 2025—a three-week sprint that underscores the severity. CISA also published a detailed list of mitigations, including monitoring Entra audit logs, reviewing Microsoft logs, auditing application registrations and service principles in Entra, and tightening conditional access policies. The agency’s broader warning—that this is part of a “larger campaign targeting various SaaS companies”—puts every provider that integrates with Microsoft 365 on notice.

Commvault’s Countermeasures: Rotation, Monitoring, and IoCs

In the aftermath, Commvault has rolled out a series of technical and procedural defenses. The company enhanced its cryptographic key rotation cadence, ensuring that compromised secrets are invalidated more frequently. It strengthened monitoring rules across its entire infrastructure, using the patterns observed during the attack to detect similar lateral movement. Perhaps most helpfully for the wider community, Commvault released indicators of compromise (IoCs), including specific IP addresses linked to the malicious activity. Organizations are urged to block those IPs at their perimeter and scan for any matching traffic in historical logs.

Beyond patching, Commvault’s incident response team recommends a layered approach: rotate all application secrets between Azure and Commvault every 90 days, enforce conditional access policies that restrict logins to trusted locations and devices, and continuously monitor sign-in activity for anomalies. These steps are effective not just against CVE-2025-3928, but against the class of abuse that targets cloud-to-cloud trust relationships.

Who Is at Risk and What Should You Do?

If you use any version of Commvault between 11.20.0 and 11.36.45 and have not yet patched, your environment is exploitable. The risk is especially acute if your organization relies on Metallic for Microsoft 365 backup because the stolen secrets could still be active. Even if you have patched, the attackers may have already exfiltrated credentials that remain valid until rotated. Commvault has advised all customers to treat any existing application secrets as potentially compromised and to generate new ones immediately after applying the update.

CISA’s list of recommended actions provides a blueprint:
- Apply Commvault patches immediately.
- Review Entra sign-in logs and Microsoft 365 unified audit logs for unusual activity, especially from unfamiliar IP addresses or at odd hours.
- Examine all application registrations and service principals in Entra ID, removing any that are unused or suspicious.
- Implement conditional access policies that require multi-factor authentication and compliant devices.
- Rotate credentials every 90 days, and consider reducing the rotation cycle for the next several months while the threat landscape remains active.

The Bigger Picture: SaaS Supply Chain Under Fire

The Commvault breach is a warning shot for every SaaS company that sits between cloud platforms and end customers. These “middleware” providers hold an extraordinary concentration of trust: they store backup copies, manage identity connectors, and often possess long-lived secrets that grant near-unrestricted access to customer tenants. A single vulnerability in a backup platform can cascade into compromise of dozens or hundreds of downstream organizations. CISA’s alert that this may be a wider campaign signals that threat actors have identified and are systematically exploiting this architectural weakness.

For Microsoft-centric enterprises, the incident also highlights a reliance on application-based authentication that can be opaque. Many administrators are unaware of how many third-party apps have standing access to their tenant, and even fewer audit those permissions regularly. The Commvault attack succeeded in part because the secrets were centrally stored and accessible once the Web Server was breached—a single point of failure that many SaaS vendors replicate.

Industry Reaction and Forward Outlook

Cybersecurity professionals have responded with a mix of concern and recognition that such attacks were inevitable. The combination of a zero-day and a nation-state actor elevates the incident beyond typical ransomware or cybercrime. It suggests espionage objectives—perhaps intellectual property theft, geopolitical intelligence gathering, or supply chain disruption. The fact that Commvault is cooperating with the FBI and CISA, while sharing IoCs publicly, sets a standard for transparency that other vendors may need to emulate as cloud-to-cloud attacks become more common.

Looking ahead, expect increased regulatory scrutiny on SaaS providers that handle sensitive data. The SEC’s cyber disclosure rules, the EU’s DORA, and other regulations may require faster notification and more detailed post-mortems. Vendors will likely face pressure to redesign architectures that rely on long-lived secrets, moving toward ephemeral credentials and zero-trust principles even for backup operations. For now, the immediate priority is patching, credential rotation, and heightened monitoring—because the same attackers may still be probing for the next vulnerable connector.