CVE-2011-2397: Ironmountain Connected Backup

High severity, CVSS 10.0. EPSS: 5.3% chance of exploitation in the next 30 days.

The Agent service in Iron Mountain Connected Backup 8.4 allows remote attackers to execute arbitrary code via a crafted opcode 13 request that triggers use of the LaunchCompoundFileAnalyzer class to send request data to the System.getRunTime.exec method.

Affected products

• Ironmountain Connected Backup: version 8.4 only

Published 2011-12-05. Last modified 2026-06-16.