CISA Alerts on Threat Actors Targeting Commvault Azure App to Steal Secrets

On Thu, May 22, 2025, Commvault, an enterprise data backup provider, issued an advisory regarding cyber threats targeting its Metallic SaaS application, hosted on Microsoft Azure.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed exploitation of a zero-day vulnerability (CVE-2025-3928) in Commvault’s web server, enabling unauthorized access to client secrets for the Metallic Microsoft 365 (M365) backup solution.

These application secrets, used for authenticating access to customer M365 environments, were stored by Commvault for its clients. The compromise could allow attackers to access customers’ M365 environments, posing risks to sensitive data.

CISA indicated this incident is part of a broader campaign targeting cloud applications with default configurations and elevated permissions. Commvault stated there is no evidence of unauthorized access to backup data or impact on business operations. The company rotated affected credentials and enhanced security controls.

Technical Details: Exploited Vulnerabilities and Attack Vectors

The primary vulnerability, CVE-2025-3928 , allowed remote attackers to execute web shells on the Commvault server. This facilitated lateral movement and potential credential theft. The attack was detected after Microsoft notified Commvault of unauthorized activity in Feb 2025, attributed to a nation-state threat actor.

Another critical vulnerability, CVE-2025-34028, was identified in the Commvault Command Center. Rated with a CVSS score of 10/10, it is a path traversal vulnerability enabling remote code execution via malicious ZIP file uploads.

Monitoring Microsoft Entra audit logs for unauthorized modifications to service principals associated with Commvault applications. Reviewing unified audit logs and conducting internal threat hunting. Implementing conditional access policies to restrict authentication to approved IP addresses within Commvault’s allowlisted range. Regularly rotating application secrets and credentials, recommending at least every 30 days.

CISA added CVE-2025-3928 and CVE-2025-34028 to its Known Exploited Vulnerabilities catalog, mandating immediate patching by federal agencies. Commvault has released patches for affected versions (11.38.20 and 11.38.25), ensuring correct sub-versions are installed.

Restricting access to Commvault management interfaces to trusted networks. Deploying a Web Application Firewall (WAF) to detect and block path traversal attempts. Reviewing application registrations and service principals for excessive privileges. Applying M365 security best practices as outlined in CISA’s Secure Cloud Business Applications project.

Organizations are urged to report incidents to CISA’s 24/7 Operations Center. CISA and Commvault collaborate with industry partners to monitor for further malicious activity and update mitigation guidance.

Client Secrets : Credentials used by applications to authenticate to cloud services. Service Principal : An identity used by applications to access resources in Azure. Remote Code Execution (RCE) : An attack allowing execution of arbitrary code on a target system. Path Traversal : A vulnerability allowing attackers to access directories and execute files outside the intended directory. Web Shell : A script enabling remote control of a web server. Conditional Access Policy : Security controls restricting access based on conditions, such as IP address.

Example Code Snippet for Conditional Access Policy (PowerShell):

New-AzureADMSConditionalAccessPolicy -DisplayName "Restrict Commvault App" ` -Conditions @{ Applications = @{ IncludeApplications = @("<AppID>") } } ` -GrantControls @{ BuiltInControls = @("mfa") } ` -Locations @{ IncludeLocations = @("<TrustedIPRangeID>") }

This policy restricts authentication for the Commvault application to a trusted IP range, enhancing security for single-tenant environments.

Based on reporting by GBHackers.