Read the docs
TI-2018-12985 Aliases CVE-2018-18367GHSA-5v9p-r9hp-37jv

Untrusted search path in Symantec Endpoint Protection Manager

Priority LOW 37CWE-426Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-426.

Summary

Symantec Endpoint Protection Manager (SEPM) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead.

Why it matters now

EPSS 0.01656 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SymantecSymantec Endpoint Protection ManagerPrior to and including 12.1 RU6 MP9; Prior to 14.2 RU1—No fix listedCNA
  • Symantec Endpoint Protection Manager VendorSymantec Affected Prior to and including 12.1 RU6 MP9; Prior to 14.2 RU1 Fixed in — No fix listed CNA

CPE configurations NVD · 32

CPEVersionsRoleVendor
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:rtm:*:*:*:*:*:*12.1 rtmVulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru1:*:*:*:*:*:*12.1 ru1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru1-mp1:*:*:*:*:*:*12.1 ru1-mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru2:*:*:*:*:*:*12.1 ru2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru2-mp1:*:*:*:*:*:*12.1 ru2-mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru3:*:*:*:*:*:*12.1 ru3VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru4:*:*:*:*:*:*12.1 ru4VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru4-mp1:*:*:*:*:*:*12.1 ru4-mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru4-mp1a:*:*:*:*:*:*12.1 ru4-mp1aVulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru4-mp1b:*:*:*:*:*:*12.1 ru4-mp1bVulnerableSymantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:rtm:*:*:*:*:*:* Versions 12.1 rtm Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru1:*:*:*:*:*:* Versions 12.1 ru1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru1-mp1:*:*:*:*:*:* Versions 12.1 ru1-mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru2:*:*:*:*:*:* Versions 12.1 ru2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru2-mp1:*:*:*:*:*:* Versions 12.1 ru2-mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru3:*:*:*:*:*:* Versions 12.1 ru3 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru4:*:*:*:*:*:* Versions 12.1 ru4 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru4-mp1:*:*:*:*:*:* Versions 12.1 ru4-mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru4-mp1a:*:*:*:*:*:* Versions 12.1 ru4-mp1a Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru4-mp1b:*:*:*:*:*:* Versions 12.1 ru4-mp1b Vulnerable ·Symantec
Show 22 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru4a:*:*:*:*:*:*12.1 ru4aVulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru5:*:*:*:*:*:*12.1 ru5VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6:*:*:*:*:*:*12.1 ru6VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp1:*:*:*:*:*:*12.1 ru6-mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp1a:*:*:*:*:*:*12.1 ru6-mp1aVulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp2:*:*:*:*:*:*12.1 ru6-mp2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp3:*:*:*:*:*:*12.1 ru6-mp3VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp4:*:*:*:*:*:*12.1 ru6-mp4VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp5:*:*:*:*:*:*12.1 ru6-mp5VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp6:*:*:*:*:*:*12.1 ru6-mp6VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp7:*:*:*:*:*:*12.1 ru6-mp7VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp8:*:*:*:*:*:*12.1 ru6-mp8VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp9:*:*:*:*:*:*12.1 ru6-mp9VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:14:*:*:*:*:*:*:*14VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:14:mp1:*:*:*:*:*:*14 mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:14:mp2:*:*:*:*:*:*14 mp2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:14.0.1:*:*:*:*:*:*:*14.0.1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:14.0.1:mp1:*:*:*:*:*:*14.0.1 mp1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:14.0.1:mp2:*:*:*:*:*:*14.0.1 mp2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:14.1:*:*:*:*:*:*:*14.1VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:14.2:*:*:*:*:*:*:*14.2VulnerableSymantec
cpe:2.3:a:symantec:endpoint_protection_manager:14.2:mp1:*:*:*:*:*:*14.2 mp1VulnerableSymantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru4a:*:*:*:*:*:* Versions 12.1 ru4a Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru5:*:*:*:*:*:* Versions 12.1 ru5 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6:*:*:*:*:*:* Versions 12.1 ru6 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp1:*:*:*:*:*:* Versions 12.1 ru6-mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp1a:*:*:*:*:*:* Versions 12.1 ru6-mp1a Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp2:*:*:*:*:*:* Versions 12.1 ru6-mp2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp3:*:*:*:*:*:* Versions 12.1 ru6-mp3 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp4:*:*:*:*:*:* Versions 12.1 ru6-mp4 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp5:*:*:*:*:*:* Versions 12.1 ru6-mp5 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp6:*:*:*:*:*:* Versions 12.1 ru6-mp6 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp7:*:*:*:*:*:* Versions 12.1 ru6-mp7 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp8:*:*:*:*:*:* Versions 12.1 ru6-mp8 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:12.1:ru6-mp9:*:*:*:*:*:* Versions 12.1 ru6-mp9 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:14:*:*:*:*:*:*:* Versions 14 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:14:mp1:*:*:*:*:*:* Versions 14 mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:14:mp2:*:*:*:*:*:* Versions 14 mp2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:14.0.1:*:*:*:*:*:*:* Versions 14.0.1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:14.0.1:mp1:*:*:*:*:*:* Versions 14.0.1 mp1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:14.0.1:mp2:*:*:*:*:*:* Versions 14.0.1 mp2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:14.1:*:*:*:*:*:*:* Versions 14.1 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:14.2:*:*:*:*:*:*:* Versions 14.2 Vulnerable ·Symantec
  • cpe:2.3:a:symantec:endpoint_protection_manager:14.2:mp1:*:*:*:*:*:* Versions 14.2 mp1 Vulnerable ·Symantec

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-18367
  2. 2026-10-03 Alias added: GHSA-5v9p-r9hp-37jv

References

Advisory 1

  • TI-2015-01347 The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before… CVSS 2.0HIGH 7.5
  • TI-2013-04383 The management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before… CVSS 2.0HIGH 7.5
  • TI-2015-01350 The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before… CVSS 2.0HIGH 8.5
  • TI-2015-01348 The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before… CVSS 2.0MEDIUM 5.5
  • TI-2013-04384 SQL injection vulnerability in the management console in Symantec Endpoint Protection… CVSS 2.0MEDIUM 6.5
  • TI-2015-06762 The SysPlant.sys driver in the Application and Device Control (ADC) component in the… CVSS 3.0HIGH 8.8
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences