CISA says SaaS providers in firing line after Commvault zero-day Azure attack

The Cybersecurity and Infrastructure Security Agency (CISA) is warning that SaaS companies are under fire from criminals on the prowl for cloud apps with weak security. Apps with default configurations and elevated permissions are the aim of these attacks, although the US agency did not attribute the activity to a specific group in a message issued this week. However, the warning follows an advisory published by data security biz Commvault earlier this month, which revealed unauthorized activity was detected in its Azure environments. Danielle Sheer, chief trust officer at Commvault, said in a blog post that Microsoft contacted the company in February, reporting signs that nation-state baddies had broken into Commvault's systems. A separate advisory at the time confirmed that "a handful of customers" were affected after the suspected nation-state attackers exploited a Commvault zero-day (CVE-2025-3928 – 8.7). That vulnerability remains unspecified, but it requires authenticated credentials in order to make use of it. It was added to CISA's Known Exploited Vulnerability (KEV) catalog on April 28 with the added detail that successful exploitation can lead to remote attackers creating and executing web shells. Each KEV entry also lists whether the vulnerability is known to be used in ransomware attacks. In this case, the value for CVE-2025-3928 is "unknown." Sheer confirmed there was no access to the data Commvault protects for its customers and the event had no impact on Commva...