Read the docs
TI-2018-08781 Aliases CVE-2018-12242GHSA-76r2-2w4r-76jq

Improper authentication in Symantec Messaging Gateway

Priority MEDIUM 47CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to an authentication bypass exploit, which is a type of issue that can allow attackers to potentially circumvent security mechanisms currently in place and gain access to the system or network.

Why it matters now

EPSS 0.02951 87th percentileScored 2026-11-07
Fix Fixed Symantec Messaging Gateway (Symantec Corporation): 10.6.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SymantecSymantec Messaging Gatewaybefore 10.6.610.6.6Patch availableCNA
  • Symantec Messaging Gateway VendorSymantec Affected before 10.6.6 Fixed in 10.6.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:symantec:messaging_gateway:*:*:*:*:*:*:*:*before 10.6.6VulnerableSymantec
  • cpe:2.3:a:symantec:messaging_gateway:*:*:*:*:*:*:*:* Versions before 10.6.6 Vulnerable ·Symantec

Remediation

  • Fix · CNA Symantec Messaging Gateway (Symantec Corporation) Fixed in 10.6.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-12242
  2. 2026-10-03 Alias added: GHSA-76r2-2w4r-76jq

References

Advisory 1

  • TI-2017-04156 The Symantec Messaging Gateway can encounter an issue of remote code execution, which… CVSS 3.0CRITICAL 10.0
  • TI-2012-03102 Symantec Messaging Gateway (SMG) before 10.0 has a default password for an unspecified… CVSS 2.0HIGH 7.9
  • TI-2016-04608 Directory traversal vulnerability in the charting component in Symantec Messaging Gateway… CVSS 3.0MEDIUM 6.5
  • TI-2012-03702 Multiple directory traversal vulnerabilities in the management console in Symantec… CVSS 2.0MEDIUM 5.0
  • TI-2012-05122 Multiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in… CVSS 3.1HIGH 7.8
  • TI-2016-02012 The management console on Symantec Messaging Gateway (SMG) Appliance devices before… CVSS 3.0HIGH 7.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences