CVE-2024-13975: Local Privilege Escalation in Commvault File Server Agent

The impact of CVE-2024-13975 is significant, as it allows a local attacker, possessing only client system access, to escalate privileges and potentially compromise the entire Commvault backup infrastructure. An attacker could leverage this vulnerability to gain unauthorized access to sensitive data stored within backups, modify backup configurations, or disrupt backup operations. Lateral movement becomes possible, allowing the attacker to move between access nodes and potentially gain control of the Commvault server itself. This vulnerability shares similarities with other local privilege escalation exploits, where attackers exploit weaknesses in system services or drivers to gain elevated privileges.

1. Reserved2025-07-23
2. Published2025-07-25
3. Modified2025-11-22
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-13975 is to upgrade the Commvault File Server Agent to a patched version: 11.32.60, 11.34.34, or 11.36.8. If an immediate upgrade is not feasible, consider implementing stricter access controls on the client systems hosting the agent to limit the potential impact of a successful attack. Review and harden the permissions granted to the agent's service account. While a WAF or proxy cannot directly mitigate this local privilege escalation, network segmentation can limit lateral movement if the agent is compromised. After upgrading, verify the fix by attempting to reproduce the vulnerability using known exploitation techniques and confirming that the privilege escalation is prevented.