Local Privilege Escalation Vulnerability in Commvault for Windows
CVE-2024-13975

8.5HIGH

Key Information:

Vendor

Commvault

Status
Commvault
Vendor
CVE Published:
25 July 2025

What is CVE-2024-13975?

A local privilege escalation vulnerability in Commvault for Windows allows an authenticated attacker to compromise designated Windows access nodes from a client system hosting the file server agent. This vulnerability enables the attacker to gain unauthorized access and perform lateral movement within the backup infrastructure, potentially leading to further security breaches. Resolutions have been implemented in versions 11.32.60, 11.34.34, and 11.36.8.

Affected Version(s)

Commvault Windows 11.20.0 < 11.32.60

Commvault Windows 11.28.0 < 11.32.60

Commvault Windows 11.32.0 < 11.32.60

References

https://documentation.commvault.com/securityadvisories/CV...
vendor-advisorypatch
https://www.vulncheck.com/advisories/commvault-for-window...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Commvault
.
CVE-2024-13975 : Local Privilege Escalation Vulnerability in Commvault for Windows