An unknown nation-state threat actor exploited CVE-2025-3928, a critical remote code execution vulnerability (CVSS 8.7/10), to breach Commvault’s Microsoft Azure environment and deploy webshells, although Commvault confirmed no unauthorized access to customer backup data or material business impact. The vulnerability, which affects Commvault software versions prior to 11.36.46, 11.32.89, 11.28.141, and 11.20.217, was initially exploited as a zero-day before being patched in late February 2025. Commvault learned of the intrusion from Microsoft on February 20, 2025, and has since rotated credentials, improved security monitoring, and notified authorities. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-3928 to its Known Exploited Vulnerabilities (KEV) catalog, requiring agencies to patch by no later than May 19, 2025. Commvault is working closely with impacted customers and has published indicators of compromise (IoCs), including five (5) attacker IP addresses, urging users to block these, apply Conditional Access policies to Microsoft services, rotate secrets every 90 days, and closely monitor Azure sign-ins to detect any unauthorized access attempts. CTIX analysts urge alla dministrators to patch this vulnerability and follow the defensive guidance immediately to prevent future exploitation.