CVE-2024-13976CWE-427

Commvault 11.20.0 - 11.36.0 Windows Maintenance Installer DLL Injection

High · published July 25, 2025

CVSS v4.0
8.5
EPSS
0%
Percentile
9.3
In the wild
Unconfirmed
What it is

A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates, an attacker with local access may exploit uncontrolled search path or DLL loading behavior to execute arbitrary code with elevated privileges. The vulnerability has been resolved in versions 11.20.202, 11.28.124, 11.32.65, 11.34.37, and 11.36.15.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00199 · 9.3th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2025-07-25T15:50Z
EPSS history
Timeline
  • 25 JUL 15:50Z
    Commvault 11.20.0 - 11.36.0 Windows Maintenance Installer DLL Injection
    cvelistv5