CVE-2024-13975

published 2025-07-25

CVE-2024-13975: A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected…

Priority P3 43 high 8.5 CVSS 4.0

AV L AC L AT N PR L UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations, a local attacker who owns a client system with the file server agent installed can compromise any assigned Windows access nodes. This may allow unauthorized access or lateral movement within the backup infrastructure. The issue has been resolved in versions 11.32.60, 11.34.34, and 11.36.8.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
commvault	commvault	>= 11.20.0 < 11.32.60	11.32.60
commvault	commvault	>= 11.28.0 < 11.32.60	11.32.60
commvault	commvault	>= 11.32.0 < 11.32.60	11.32.60
commvault	commvault	>= 11.34.0 < 11.34.34	11.34.34
commvault	commvault	>= 11.36.0 < 11.36.8	11.36.8

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-269