Skip to content
Fencer Vulns
high 7.8

CVE-2018-20735 json

An issue was discovered in BMC PATROL Agent through 11.3.01.

published 2019-01-17 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-13280

cvss
7.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
7.5%
EPSS 7.5% chance of exploitation in 30 days, percentile 94%
public exploits
2
Metasploit, Exploit-DB

Summary

An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if the password provided for the given username is correct; it does not verify the permissions of the user on the network. This means if you have PATROL Agent installed on a high value target (domain controller), you can use a low privileged domain user to authenticate with PatrolCli and then connect to the domain controller and run commands as SYSTEM. This means any user on a domain can escalate to domain admin through PATROL Agent. NOTE: the vendor disputes this because they believe it is adequate to prevent this escalation by means of a custom, non-default configuration

Timeline

  1. First public exploit (Metasploit exploit/multi/misc/bmc_patrol_cmd_exec)
  2. Published

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

7.49% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/multi/misc/bmc_patrol_cmd_exec BMC Patrol Agent Privilege Escalation Cmd Execution metasploit exploit, excellent rank, 2019-01-17
  • EDB-46556 BMC Patrol Agent - Privilege Escalation Code Execution Execution (Metasploit) remote, 2019-03-18
  • securifera.com https://www.securifera.com/blog/2018/12/17/bmc-patrol-agent-domain-user-to-domain-admin/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.