CVE-2024-13975
highpriority · track · 0EPSS 0.001 · 3 %ileEUEPSS · scored 2026-10-27
A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations, a local attacker who owns a client system with the file server agent installed can compromise any assigned Windows access nodes. This may allow unauthorized access or lateral movement within the backup infrastructure. The issue has been resolved in versions 11.32.60, 11.34.34, and 11.36.8.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.9–8.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2024-13975cnnvd
- https://documentation.commvault.com/securityadvisories/CV_2024_09_1.htmlcnnvd
- https://www.vulncheck.com/advisories/commvault-for-windows-access-nodes-compromisecnnvd
- https://documentation.commvault.com/securityadvisories/CV_2024_09_1.htmlenisa_euvd
- https://www.vulncheck.com/advisories/commvault-for-windows-access-nodes-compromiseenisa_euvd
- https://documentation.commvault.com/securityadvisories/CV_2024_09_1.htmlnvd
- https://www.vulncheck.com/advisories/commvault-for-windows-access-nodes-compromisenvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan