Securing Your Cloud Environment when using SaaS Products

What is affected, what to do

SingCERT has observed reports of possible cyber threat activities targeting Commvault’s Metallic SaaS platform. As more organisations shift to the cloud, understanding the security implications of SaaS and implementing best practices is crucial.

The available sources name no fixed version. Check the vendor guidance in the references below.

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Handle the vulnerability in regular vulnerability handling under Art. 21(2)(e) NIS2.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

SingCERT has observed reports of possible cyber threat activities targeting Commvault’s Metallic SaaS platform. As more organisations shift to the cloud, understanding the security implications of SaaS and implementing best practices is crucial. SingCERT has observed reports of possible cyber threat activities targeting Commvault’s Metallic Software-as-a-Service (SaaS) platform, a popular solution for Microsoft 365 (M365) data backups. If the threat actors successfully accessed client secrets stored in the aforementioned SaaS solution, they could gain unauthorised access to Commvault's clients' M365 environment. This incident may be part of a broader and growing trend where attackers target SaaS platforms as a gateway to sensitive enterprise data. As more organisations shift to the cloud, understanding the security implications of SaaS adoption and implementing best practices is crucial. What is SaaS? Software-as-a-Service (SaaS) is a cloud-based model where applications are delivered over the internet. Rather than being installed on local machines or servers, SaaS solutions are hosted by third-party providers and accessed through web browsers or APIs. Examples include M365, Google Workspace, Salesforce, Dropbox, and Commvault Metallic. SaaS platforms offer scalability, accessibility, and cost-efficiency, but they also introduce shared responsibility models, where the provider secures the infrastructure, while clients must secure usage, access, and data configurations. How to Protect Yourself Individuals and organisations are advised to adopt the following measures to strengthen their cybersecurity posture and boost online defences, safeguarding both personal and organisational data. For Individuals (End Users) Always create strong, unique passwords for each SaaS account, and use a password manager to securely store them Enable multi-factor authentication (MFA) on all SaaS platforms, especially for critical services like email, storage, and productivity tools Stay vigilant against phishing attacks by verifying email senders, avoid clicking on suspicious links or login prompts,and refraining from opening or downloading unknown attachments Regularly review and manage third-party applications that have access to your SaaS accounts, and revoke permissions for apps you no longer use or recognise Log out of SaaS accounts after using shared or public devices to prevent unauthorised access Immediately report any suspicious activity such as unfamiliar login attempts or unexpected account changes to your organisation’s IT or security team Keep all software (browsers, apps, and device OS) up to date, as attackers often exploit unpatched vulnerabilities to gain access to SaaS sessions or credentials For Organisations Implement a robust Identity and Access Management (IAM) system to enforce role-based access control and the principle of least privilege across all SaaS platforms Encrypt data when it's stored and during transfer to prevent unauthorised access or interception Make multi-factor authentication (MFA) mandatory for all users, especially those with administrative or sensitive data access Conduct regular audits of user accounts, permissions, and connected applications to identify and eliminate unnecessary or risky access Monitor SaaS application activity by enabling detailed audit logs and integrating them with a Security Information and Event Management (SIEM) system Educate employees regularly through cybersecurity awareness training that includes SaaS-specific risks, such as phishing and unauthorised app integrations Evaluate the security posture of all SaaS vendors before adoption, and stay informed of any vulnerabilities or incidents related to the services you use Maintain regular, independent backups of all critical SaaS-hosted data, and test restoration procedures to ensure business continuity during disruptions Use SaaS Security Posture Management (SSPM) tools to automate the detection of configuration issues, access risks, and compliance violations across your SaaS environment Establish a patch and vulnerability management process for any connected agents, local components, plugins, or integrations associated with your SaaS platforms to ensure known vulnerabilities are promptly addressed While SaaS platforms streamline operations and reduce infrastructure burdens, they are not immune to cyber threats. Incidents like the one involving Commvault’s Metallic platform serve as a stark reminder that cloud-based convenience must be matched with rigorous security practices. Organisations are urged to review their SaaS security posture, especially for platforms that handle sensitive data or administrative access. References: https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic https://thehackernews.com/2025/05/cisa-warns-of-suspected-broader-saas.html https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/cloud-security-best-practices/ https://www.paloaltonetworks.com/cyberpedia/17-ways-to-secure-when-deploying-cloud-environments

Source: CSA/SingCERT