Read the docs
TI-2025-03166 Aliases CVE-2025-3599GHSA-m76m-45c7-gvr3

Symantec Endpoint Protection Elevation of Privilege

Priority LOW 33CWE-367Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Symantec Endpoint Protection Windows Agent, running an ERASER Engine prior to 119.1.7.8, may be susceptible to an Elevation of Privilege vulnerability, which may allow an attacker to delete resources that are normally protected from an application or user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0029 21st percentileScored 2026-11-07
Fix Fixed Symantec Endpoint Protection (Symantec): 119.1.7.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SymantecSymantec Endpoint Protection—119.1.7.8Patch availableCNA
  • Symantec Endpoint Protection VendorSymantec Affected — Fixed in 119.1.7.8 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:broadcom:symantec_eraser_engine:*:*:*:*:*:*:*:*before 119.1.7.8VulnerableBroadcom
cpe:2.3:a:broadcom:symantec_endpoint_protection:-:*:*:*:*:windows:*:*not specified by NVDRunning onBroadcom
  • cpe:2.3:a:broadcom:symantec_eraser_engine:*:*:*:*:*:*:*:* Versions before 119.1.7.8 Vulnerable ·Broadcom
  • cpe:2.3:a:broadcom:symantec_endpoint_protection:-:*:*:*:*:windows:*:* Versions not specified by NVD Running on ·Broadcom

Remediation

  • Fix · CNA Symantec Endpoint Protection (Symantec) Fixed in 119.1.7.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-3599
  2. 2026-10-03 Alias added: GHSA-m76m-45c7-gvr3

References

Advisory 1

  • TI-2017-04157 Command injection in Symantec Messaging Gateway KEVCVSS 3.1HIGH 8.8
  • TI-2009-01353 The Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2)… CVSS 2.0HIGH 10.0
  • TI-2017-04156 The Symantec Messaging Gateway can encounter an issue of remote code execution, which… CVSS 3.0CRITICAL 10.0
  • TI-2012-00284 The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict… CVSS 2.0HIGH 10.0
  • TI-2006-02539 Stack-based buffer overflow in Symantec Antivirus 10.1 and Client Security 3.1 allows… CVSS 2.0HIGH 10.0
  • TI-2012-02563 The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote… CVSS 2.0HIGH 10.0
See all 597 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences