Vulnerability · Published Jul 25, 2025 · Assigned by VulnCheck

CVE-2024-13975Commvault 11.20.0 - 11.36.0 Windows Access Nodes Compromise via Local File Server Agent Abuse

High 8.5

In plain English

A high-severity privilege mismanagement in Commvault from Commvault. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 4.0)8.5High

Exploit odds (30 days)0.1%top 96.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A local privilege escalation vulnerability exists in Commvault for Windows versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations, a local attacker who owns a client system with the file server agent installed can compromise any assigned Windows access nodes. This may allow unauthorized access or lateral movement within the backup infrastructure. The issue has been resolved in versions 11.32.60, 11.34.34, and 11.36.8.

Affected products (as reported)

Vendor	Product	Versions
Commvault	Commvault	11.20.0 – before 11.32.6011.28.0 – before 11.32.6011.32.0 – before 11.32.6011.34.0 – before 11.34.3411.36.0 – before 11.36.8

Weakness: CWE-269 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://documentation.commvault.com/securityadvisories/CV_2024_09_1.html vendor-advisory, patch
https://www.vulncheck.com/advisories/commvault-for-windows-access-nodes-compromise third-party-advisory