CVE-2020-35593

BMC PATROL Agent through 20.08.00 allows local privilege escalation via vectors involving pconfig +RESTART -host.

• CWE-269

• http://web.archive.org/web/20210106175128/https://community.bmc.com/s/article/SECURITY-Patrol-Agent-Local-Privilege-Escalation-in-BMC-PATROL-Agent-CVE-2020-35593Broken Link
• https://community.bmc.com/s/article/SECURITY-Patrol-Agent-Local-Privilege-Escalation-in-BMC-PATROL-Agent-CVE-2020-35593Broken Link
• https://webapps.bmc.com/support/faces/az/prodallversions.jsp?seqid=304517Product
• https://www.securifera.com/advisories/Third Party Advisory
• https://www.securifera.com/blog/2021/03/08/bmc-patrol-agent-domain-user-to-domain-admin-part-2/Exploit, Third Party Advisory
• http://web.archive.org/web/20210106175128/https://community.bmc.com/s/article/SECURITY-Patrol-Agent-Local-Privilege-Escalation-in-BMC-PATROL-Agent-CVE-2020-35593Broken Link
• https://community.bmc.com/s/article/SECURITY-Patrol-Agent-Local-Privilege-Escalation-in-BMC-PATROL-Agent-CVE-2020-35593Broken Link
• https://webapps.bmc.com/support/faces/az/prodallversions.jsp?seqid=304517Product
• https://www.securifera.com/advisories/Third Party Advisory
• https://www.securifera.com/blog/2021/03/08/bmc-patrol-agent-domain-user-to-domain-admin-part-2/Exploit, Third Party Advisory

Published

Sep 5, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35588Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-35589The limit-login-attempts-reloaded plugin before 2.17.4 for W…5.4
• CVE-2020-3559A vulnerability in Cisco Aironet Access Point (AP) Software …8.6
• CVE-2020-35590LimitLoginAttempts.php in the limit-login-attempts-reloaded …9.8
• CVE-2020-35591Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The app…5.4
• CVE-2020-35592Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options heade…5.4
• CVE-2020-35594Zoho ManageEngine ADManager Plus before 7066 allows XSS.6.1
• CVE-2020-35597Victor CMS 1.0 is vulnerable to SQL injection via c_id param…8.8
• CVE-2020-35598ACS Advanced Comment System 1.0 is affected by Directory Tra…7.5
• CVE-2020-3560A vulnerability in Cisco Aironet Access Points (APs) could a…8.6
• CVE-2020-35604An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is u…9.8
• CVE-2020-35605The Graphics Protocol feature in graphics.c in kitty before …9.8