CVE-2024-13976

HIGH EPSS 7.8%

Published Jul 25, 202511mo ago · Modified Jun 17, 20261w ago

8.5 CVSS 4.0

High

Published Jul 25, 2025 11mo ago

Last Modified Jun 17, 2026 1w ago

Description

A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates, an attacker with local access may exploit uncontrolled search path or DLL loading behavior to execute arbitrary code with elevated privileges. The vulnerability has been resolved in versions 11.20.202, 11.28.124, 11.32.65, 11.34.37, and 11.36.15.

CVSS Details

Base Score

8.5

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

7.8% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-427

References 2

documentation.commvault.com https://documentation.commvault.com/securityadvisories/CV_2024_09_2.html
vulncheck.com https://www.vulncheck.com/advisories/commvault-for-windows-maintenance-installer-dll-injection

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.