CVE-2024-13975
High
Description
A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations, a local attacker who owns a client system with the file server agent installed can compromise any assigned Windows access nodes. This may allow unauthorized access or lateral movement within the backup infrastructure. The issue has been resolved in versions 11.32.60, 11.34.34, and 11.36.8.
SeverityHigh
CVSS8.5
Exploit probability—
ProductCommvault
PublishedJul 25, 2025
First seenJul 25, 2025
Weakness typeCWE-269Improper privilege management
How to fix
Update
- Commvault Commvault11.32.60, 11.34.34, 11.36.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Commvault Commvault | 11.20.0 ≤ v < 11.32.60, 11.28.0 ≤ v < 11.32.60, 11.32.0 ≤ v < 11.32.60, 11.34.0 ≤ v < 11.34.34, 11.36.0 ≤ v < 11.36.8 | 11.32.60, 11.34.34, 11.36.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.