CVE-2024-13975CWE-269

Commvault 11.20.0 - 11.36.0 Windows Access Nodes Compromise via Local File Server Agent Abuse

High · published July 25, 2025

CVSS v4.0
8.5
EPSS
0%
Percentile
2.3
In the wild
Unconfirmed
What it is

A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations, a local attacker who owns a client system with the file server agent installed can compromise any assigned Windows access nodes. This may allow unauthorized access or lateral movement within the backup infrastructure. The issue has been resolved in versions 11.32.60, 11.34.34, and 11.36.8.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00129 · 2.3th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-07-25T15:49Z
EPSS history
Timeline
  • 25 JUL 15:49Z
    Commvault 11.20.0 - 11.36.0 Windows Access Nodes Compromise via Local File Server Agent Abuse
    cvelistv5