CVE-2018-20735

CVE-2018-20735 describes a privilege escalation vulnerability in BMC PATROL Agent through version 11.3.01. The PatrolCli application, by default, only validates user passwords without verifying network permissions, allowing a low-privileged domain user to execute commands as SYSTEM on a high-value target like a domain controller. This vulnerability carries a CVSS score of 7.8 (High) due to its low attack complexity and significant impact on confidentiality, integrity, and availability. While not listed in CISA KEV, a Metasploit module exists for exploitation, and its EPSS score indicates a higher than average exploitability probability. Despite the vendor disputing the severity, this flaw presents a critical risk for lateral movement and domain administrator escalation within affected Windows Active Directory environments.