Data Loss Prevention CVE-2026-3991

Attacker requires low-privilege local user access to Windows system running Symantec Data Loss Prevention versions prior to 25.1 MP1, 16.1 MP2, 16.0 RU2 HF9, 16.0 RU1 MP1 HF12, or 16.0 MP2 HF15. No user interaction needed.

The CVSS 7.8 score reflects high impact across confidentiality, integrity, and availability (C:H/I:H/A:H) once exploited, but the local attack vector (AV:L) and low-privileged authentication requirement (PR:L) significantly constrain real-world risk. An attacker needs existing local access, meaning this vulnerability primarily threatens environments with shared workstations, compromised user accounts, or as a post-exploitation pivot after initial access via phishing or other vectors. The low attack complexity (AC:L) indicates reliable exploitation once local access is achieved. No KEV listing or public exploit code is identified, suggesting limited active exploitation to date. However, privilege escalation vulnerabilities in endpoint security agents represent high-value targets for ransomware operators and advanced persistent threats seeking to disable monitoring before lateral movement. Organizations using DLP to protect crown-jewel data should prioritize patching despite the local-only constraint, as attackers routinely chain local privilege escalation with remote access to achieve domain compromise. The CWE-829 classification implies the vulnerability may be discoverable through standard Windows privilege escalation enumeration tools, increasing the likelihood of future exploit development.

An attacker with existing local user credentials on a corporate Windows workstation running vulnerable DLP agent software identifies writable directories in the agent's service search path through standard privilege escalation enumeration. The attacker plants a malicious DLL with a name matching one the DLP service attempts to load during startup or operation. When the DLP agent service restarts or the system reboots, the service loads the attacker's DLL with SYSTEM privileges, granting full control over the endpoint. The attacker can now disable DLP monitoring, exfiltrate sensitive documents without detection, install persistent backdoors, or pivot to additional network resources using the compromised SYSTEM context. While no public exploit is confirmed, the CWE-829 classification and straightforward local attack complexity suggest skilled attackers or penetration testers could develop reliable exploits with moderate effort.