CVE-2024-13976
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2024
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Commvault 11.20.0 - 11.36.0 Windows Maintenance Installer DLL Injection
A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates, an attacker with local access may exploit uncontrolled search path or DLL loading behavior to execute arbitrary code with elevated privileges. The vulnerability has been resolved in versions 11.20.202, 11.28.124, 11.32.65, 11.34.37, and 11.36.15.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Commvault for Windows
- Vendor
- Commvault
- Product
- Commvault for Windows
- Platforms
- Windows
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 11.20.0 | affected | semver | 11.20.202 | Unavailable | None listed |
| 11.28.0 | affected | semver | 11.28.124 | Unavailable | None listed |
| 11.32.0 | affected | semver | 11.32.65 | Unavailable | None listed |
| 11.34.0 | affected | semver | 11.34.37 | Unavailable | None listed |
| 11.36.0 | affected | semver | 11.36.15 | Unavailable | None listed |