Symantec IT Management Suite CVE-2026-15379

The attacker must have a valid local user account on a Windows system where Symantec IT Management Suite (Altiris) is installed and the AltirisAgent_Stream WMI provider is running - no administrator or elevated rights are required. Exploitation is limited to local access only (AV:L); it is not remotely triggerable over the network without first obtaining local code execution by other means. The CVSS 4.0 supplemental metric UI:A indicates an active step by the attacker (issuing the WMI query), but no victim interaction is needed. Impact is bounded purely to confidentiality - an attacker cannot write or delete files through this vector, and no availability impact exists. Environments where Altiris agents are absent, or where local logon is restricted to administrators only, are not exposed.

The official CVSS 4.0 score of 5.1 (Medium) is consistent with the impact profile: high confidentiality impact on the vulnerable system (VC:H) with no integrity or availability consequence, constrained to local attack vector (AV:L) requiring low privileges (PR:L). The supplemental metrics amplify practical urgency: automatable (AU:Y) and Value Density Concentrated (V:C) indicate the technique is scriptable and the accessible data is high-value. EPSS data was not provided; given no KEV listing and no reported POC, broad opportunistic exploitation appears unlikely currently, but the attack is trivially executable by any authenticated local user without special tools. The primary real-world risk is lateral credential theft - secrets, service account passwords, or private keys stored in SYSTEM-accessible paths are fully exposed to unprivileged insiders or malware running as a standard user. The CVSS score may understate business risk in environments where Altiris agents are deployed to endpoints holding sensitive data or where insider threat is a concern. No conflicting signals between CVSS and description were identified.

A standard domain user logged into a managed Windows workstation opens a PowerShell session and issues a WMI query targeting the AltirisAgent_Stream class. Because the provider does not re-impersonate the caller, it executes the file read under LocalSystem and returns the contents - the user retrieves a service configuration file containing stored credentials or a private key that is normally restricted via NTFS ACLs to SYSTEM/Administrators only. No public exploit code has been identified at time of analysis, but the attack requires only a PowerShell one-liner invoking Get-WmiObject or CIM cmdlets.