CISA Updates Alert On Commvault Metallic Exploitation

## Executive Summary CISA warns of active supply-chain exploitation of Commvault’s Metallic SaaS backup platform where attackers leveraged stolen service-principal credentials and poorly stored client secrets to authenticate to customer Microsoft Entra ID tenants (CVE-2025-3928 is listed in CISA’s KEV); the advisory describes observed unauthorized sign-ins, credential modifications, and lateral movement into M365 environments and provides immediate mitigation, rotation, audit, and hardening guidance.