Commvault Windows Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability exists in Commvault for Windows in versions 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. In affected configurations, a local attacker with the file server agent installed on their client system can compromise any assigned Windows access nodes. This vulnerability may lead to unauthorized access or lateral movement within the backup infrastructure.

Impact

Exploitation of this vulnerability could allow a local attacker to escalate privileges, potentially leading to unauthorized access or lateral movement within the backup infrastructure by compromising assigned Windows access nodes.

Remediation

Users can upgrade to Commvault versions 11.32.60, 11.34.34, or 11.36.8 to address this vulnerability.