EUVD-2026-45151
GHSA-63vq-vxhh-x3pr
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:M/U:Red
Local vector and low privileges match description; no user interaction required to query WMI; scope unchanged; confidentiality-only impact with no write or denial capability.
Primary rating from Vendor (symantec).
CVSS VectorVendor: symantec
Lifecycle Timeline
1DescriptionCVE.org
The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user to read the contents of any file accessible to the SYSTEM account, bypassing filesystem ACLs. No admin privileges required. The provider reverts to the LocalSystem context when servicing WMI queries without re-impersonating the caller. Any local standard user can therefore read SYSTEM-readable files - including configuration files, service logs, and secrets stored with SYSTEM/Administrator-only ACLs - by querying the provider directly.
AnalysisAI
Local privilege escalation via a misconfigured WMI provider in Broadcom's Symantec IT Management Suite (Altiris) exposes SYSTEM-readable files to any local standard user. The AltirisAgent_Stream WMI class fails to re-impersonate the calling user when servicing queries, reverting to the LocalSystem context instead - allowing unprivileged local users to bypass filesystem ACLs and read files that are restricted to SYSTEM or Administrator accounts, including configuration files, service logs, and stored secrets. No public exploit has been identified at time of analysis, though the technique is mechanically straightforward for any authenticated local user; the Broadcom advisory (SA 37995) is the authoritative disclosure source.
Technical ContextAI
The affected component is the Altiris WMI provider shipped with Broadcom Symantec IT Management Suite (CPE: cpe:2.3:a:broadcom:symantec_it_management_suite:*:*:*:*:*:*:*:*). WMI providers on Windows run as host processes and are expected to impersonate the calling client's security token when servicing queries, ensuring that access control checks reflect the caller's identity. The AltirisAgent_Stream class violates this expectation: it performs file I/O under the LocalSystem account without reverting to the caller's token, effectively granting the caller the full filesystem read rights of SYSTEM. This is a classic privilege escalation through improper impersonation - analogous to CWE-269 (Improper Privilege Management) or CWE-284 (Improper Access Control) - though NVD has not yet assigned a formal CWE. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:A) confirms a local, low-complexity attack requiring only standard-user privileges.
RemediationAI
Consult and apply the remediation specified in Broadcom Security Advisory SA 37995 at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37995 - exact patched version numbers were not independently confirmed from available input data, so the advisory is the authoritative source. Until a patch is applied, restrict local interactive and remote desktop access to Altiris-managed hosts to only accounts that genuinely require it, reducing the pool of users who can invoke the vulnerable WMI class. As a compensating control, audit and relocate secrets (stored credentials, private keys, service account configurations) out of SYSTEM-owned file paths on managed endpoints to reduce the value of what the provider can expose. Note that WMI namespace ACLs could theoretically restrict access to the AltirisAgent_Stream class, but implementing custom WMI namespace restrictions without vendor guidance risks breaking legitimate Altiris functionality and should be validated in a test environment before production deployment.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today