Read the docs
TI-2020-06519 Aliases CVE-2020-8097GHSA-hjj8-487v-3m8m

Improper authentication vulnerability in Bitdefender Endpoint Security Tools and Endpoint Security SDK (VA-8646)

Priority LOW 35CWE-287Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

An improper authentication vulnerability in Bitdefender Endpoint Security Tools for Windows and Bitdefender Endpoint Security SDK allows an unprivileged local attacker to escalate privileges or tamper with the product's security settings. This issue affects: Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.18.261. This issue affects: Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.18.261. Bitdefender Endpoint Security SDK versions prior to 6.6.18.261.

Why it matters now

EPSS 0.00416 36th percentileScored 2026-11-07
Fix Fixed Endpoinit Security Tools for Windows (Bitdefender): 6.6.18.261Endpoint Security SDK (Bitdefender): 6.6.18.261

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
BitdefenderEndpoinit Security Tools for Windowsbefore 6.6.18.2616.6.18.261Patch availableCNA
BitdefenderEndpoint Security SDKbefore 6.6.18.2616.6.18.261Patch availableCNA
  • Endpoinit Security Tools for Windows VendorBitdefender Affected before 6.6.18.261 Fixed in 6.6.18.261 Patch available CNA
  • Endpoint Security SDK VendorBitdefender Affected before 6.6.18.261 Fixed in 6.6.18.261 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:bitdefender:endpoint_security:*:*:*:*:*:windows:*:*before 6.6.18.261VulnerableBitdefender
cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:windows:*:*before 6.6.18.261VulnerableBitdefender
  • cpe:2.3:a:bitdefender:endpoint_security:*:*:*:*:*:windows:*:* Versions before 6.6.18.261 Vulnerable ·Bitdefender
  • cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:windows:*:* Versions before 6.6.18.261 Vulnerable ·Bitdefender

Remediation

  • Fix · CNA Endpoinit Security Tools for Windows (Bitdefender) Fixed in 6.6.18.261
  • Fix · CNA Endpoint Security SDK (Bitdefender) Fixed in 6.6.18.261

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8097
  2. 2026-10-03 Alias added: GHSA-hjj8-487v-3m8m

References

Advisory 1

  • TI-2024-02065 Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466) CVSS 3.1CRITICAL 9.8
  • TI-2024-02064 Incorrect Regular Expression in GravityZone Update Server (VA-11465) CVSS 3.1CRITICAL 9.8
  • TI-2020-06527 Insufficient client validation in Bitdefender Endpoint Security for Mac (VA-8759) CVSS 3.1HIGH 8.8
  • TI-2025-04772 Improper access restriction to critical folder in Bitdefender Endpoint Security Tools for Mac CVSS 4.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences