Is CVE-2018-20735 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2018-20735, but active exploitation has not been confirmed.

Can CVE-2018-20735 be exploited remotely?

No. CVE-2018-20735 requires local access to exploit.

What is the CVSS score of CVE-2018-20735?

CVE-2018-20735 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2018-20735

HIGHPOC

CVE-2018-20735

CWE-287Published: January 17, 2019· Updated: Jun 17, 2026

7.8

CVSS v3.1

Official Description

An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if the password provided for the given username is correct; it does not verify the permissions of the user on the network. This means if you have PATROL Agent installed on a high value target (domain controller), you can use a low privileged domain user to authenticate with PatrolCli and then connect to the domain controller and run commands as SYSTEM. This means any user on a domain can escalate to domain admin through PATROL Agent. NOTE: the vendor disputes this because they believe it is adequate to prevent this escalation by means of a custom, non-default configuration

NVD Source

Technical Analysis

CVE-2018-20735 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

A proof-of-concept (PoC) exploit exists for CVE-2018-20735. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.