Read the docs
TI-2018-08777 Aliases CVE-2018-12238GHSA-grmv-v937-8mm8

Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 & 14.2…

Priority LOW 34Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition (SEP SBE) prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud (SEP Cloud) prior to 22.15.1 may be susceptible to an AV bypass issue, which is a type of exploit that works to circumvent one of the virus detection engines to avoid a specific type of virus protection. One of the antivirus engines depends on a signature pattern from a database to identify malicious files and viruses; the antivirus bypass exploit looks to alter the file being scanned so it is not detected.

Why it matters now

EPSS 0.00402 34th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SymantecNorton; Symantec Endpoint Protection (SEP); Symantec Endpoint Protection Small Business Edition (SEP SBE); Symantec Endpoint Protection Cloud (SEP Cloud)Prior to 22.15 [Norton]; Prior to 12.1.7454.7000 & 14.2 [Symantec Endpoint Protection (SEP)]; Prior to NIS-22.15.1.8 & SEP-12.1.7454.7000 [Symantec Endpoint Protection Small Business Edition (SEP SBE)]; Prior to 22.15.1 [Symantec Endpoint Protection Cloud (SEP Cloud)]—No fix listedCNA
  • Norton; Symantec Endpoint Protection (SEP); Symantec Endpoint Protection Small Business Edition (SEP SBE); Symantec Endpoint Protection Cloud (SEP Cloud) VendorSymantec Affected Prior to 22.15 [Norton]; Prior to 12.1.7454.7000 & 14.2 [Symantec Endpoint Protection (SEP)]; Prior to NIS-22.15.1.8 & SEP-12.1.7454.7000 [Symantec Endpoint Protection Small Business Edition (SEP SBE)]; Prior to 22.15.1 [Symantec Endpoint Protection Cloud (SEP Cloud)] Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:symantec:endpoint_protection:*:*:*:*:*:*:*:*11.0 to before 12.1.7454.7000; 14.0 – 14.2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_cloud:*:*:*:*:*:*:*:*before 22.15.1VulnerableSymantec
cpe:2.3:a:symantec:norton_antivirus:*:*:*:*:*:*:*:*before 22.15VulnerableSymantec
  • cpe:2.3:a:symantec:endpoint_protection:*:*:*:*:*:*:*:* Versions 11.0 to before 12.1.7454.7000; 14.0 – 14.2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_cloud:*:*:*:*:*:*:*:* Versions before 22.15.1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:norton_antivirus:*:*:*:*:*:*:*:* Versions before 22.15 Vulnerable ·Symantec

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-12238
  2. 2026-10-03 Alias added: GHSA-grmv-v937-8mm8

References

Advisory 1

  • TI-2009-01353 The Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2)… CVSS 2.0HIGH 10.0
  • TI-2009-01354 Multiple stack-based buffer overflows in IAO.EXE in the Intel Alert Originator Service in… CVSS 2.0HIGH 9.3
  • TI-2016-02020 The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec… CVSS 3.0HIGH 7.8
  • TI-2012-01284 The ZIP file parser in AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus… CVSS 2.0MEDIUM 4.3
  • TI-2012-01283 The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus… CVSS 2.0MEDIUM 4.3
  • TI-2012-01281 The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir… CVSS 2.0MEDIUM 4.3
See all 70 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences