CVE-2024-13975: 
Commvault vulnerability analysis and mitigation

CVE-2024-13975 is a local privilege escalation vulnerability in Commvault for Windows affecting versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. A local attacker who controls a client system with the Commvault file server agent installed can leverage this flaw to compromise any assigned Windows access nodes within the backup infrastructure. The vulnerability was published on July 25, 2025, and assigned by VulnCheck. It carries a CVSS v4.0 base score of 8.5 (High) (Red Hat CVE, ENISA EUVD).

The vulnerability is classified as CWE-269 (Improper Privilege Management), indicating that the Commvault file server agent fails to properly enforce privilege boundaries between client systems and their assigned Windows access nodes. An attacker with low-privilege local access to a client system can abuse this misconfiguration to escalate privileges and gain control over access nodes in the backup infrastructure. The attack vector is local, requires low privileges, no user interaction, and has low attack complexity, making it straightforward to exploit once local access is obtained. The vulnerability maps to CAPEC-233 (Privilege Escalation) and MITRE ATT&CK technique T1548 (Abuse Elevation Control Mechanism) (ENISA EUVD, VulnCheck Advisory).

Successful exploitation allows a low-privileged local attacker to gain unauthorized access to Windows access nodes assigned to the compromised client system, with high impact to confidentiality, integrity, and availability of the affected systems. This can enable lateral movement within the Commvault backup infrastructure, potentially exposing sensitive backup data and disrupting backup and recovery operations. The scope is limited to the vulnerable system's directly assigned access nodes, but within that scope the attacker achieves full compromise (ENISA EUVD, Red Hat CVE).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (ENISA EUVD). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.016% (0.000160), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported.

1. Gain local access: Obtain low-privilege local access to a Windows client system that has the Commvault file server agent installed and is assigned to one or more Windows access nodes.
2. Identify assigned access nodes: Enumerate the Commvault configuration on the client to identify which Windows access nodes are assigned to this client system.
3. Abuse improper privilege management: Leverage the improper privilege management flaw in the file server agent to escalate privileges, exploiting the lack of proper boundary enforcement between the client and its assigned access nodes.
4. Compromise access nodes: Use the escalated privileges to gain unauthorized control over the assigned Windows access nodes, enabling further actions such as accessing backup data, modifying backup jobs, or performing lateral movement within the backup infrastructure (VulnCheck Advisory, Commvault Advisory).

• Logs: Unexpected privilege escalation events in Windows Security Event Logs (Event ID 4672, 4673) on access nodes originating from Commvault service accounts or client system accounts.
• Process: Unusual processes spawned under elevated privileges by the Commvault file server agent on client systems or access nodes.
• Network: Unexpected lateral connections from Commvault client systems to access nodes outside of normal backup operation windows.
• File System: Unauthorized modifications to Commvault configuration files or backup job definitions on access nodes.

Commvault has released patched versions resolving this vulnerability: 11.32.60, 11.34.34, and 11.36.8. Organizations running affected versions (11.20.0, 11.28.0, 11.32.0, 11.34.0, or 11.36.0) should upgrade to the appropriate patched release as soon as possible. As interim mitigations, administrators should restrict local access to systems running the Commvault file server agent, enforce least-privilege principles, and monitor backup infrastructure for suspicious activity (Commvault Advisory, ENISA EUVD).