CVE-2019-3999: Druva Insync Client

High severity, CVSS 7.8. EPSS: 8.6% chance of exploitation in the next 30 days.

Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges.

Affected products

• Druva Insync Client: version 6.5.0 only

Published 2020-02-25. Last modified 2026-06-17.