Is CVE-2024-11220 actively exploited?

No active exploitation of CVE-2024-11220 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-11220 be exploited remotely?

No. CVE-2024-11220 requires local access to exploit.

What is the CVSS score of CVE-2024-11220?

CVE-2024-11220 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2024-11220

HIGH

CVE-2024-11220

CWE-279Published: December 6, 2024· Updated: Jun 17, 2026

7.8

CVSS v3.1

Official Description

A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Any code within the rdlx file of the report executes with SYSTEM privileges, resulting in privilege escalation.

NVD Source

Technical Analysis

CVE-2024-11220 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.