Symantec SEDR Console EUVD-2026-100477

Exploitation requires the attacker to hold a valid low-privileged authenticated account on the SEDR Console (PR:L) and requires a second victim user to interact by rendering the injected content in their session (UI:R), which is the mechanism by which the script crosses into another user's context (S:C). Impact is limited to in-session script execution (Low confidentiality and integrity, no availability impact); it does not yield direct host or server compromise. Limiting factors: no unauthenticated access, mandatory victim interaction, and applicability only to SEDR Console versions prior to 4.13 (confirmed affected: 4.12) - environments patched to 4.13 or later are not exploitable.

This is a moderate-severity stored/reflected XSS (CWE-79) in the Symantec Endpoint Detection and Response (SEDR) Console, with the vendor-supplied CVSS:3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N yielding 5.4 (Medium). The signals are internally consistent and point to a bounded, non-critical issue: network vector but low complexity, requiring an attacker to already hold a low-privileged authenticated console account (PR:L) AND requiring a victim user to interact (UI:R) by viewing the injected content. The scope-changed (S:C) with only Low confidentiality and Low integrity impact and no availability impact reflects script execution in another user's browser session rather than full host compromise. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is no evidence of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' This is a real-but-low-urgency hygiene issue: it matters because the affected product is a security console whose users are typically privileged administrators, so a successful XSS could facilitate privilege escalation or session abuse within the EDR management plane, but the dual requirements of prior authentication plus victim interaction substantially limit mass exploitation. No conflicting signals were found; the main gap is the absence of exploitation-probability (EPSS) and POC data.

A low-privileged but authenticated SEDR console user injects a malicious script payload into a console field or parameter that is later rendered to another user. When a higher-privileged administrator views that content in the SEDR Console, the script executes in their session context, potentially allowing the attacker to read or act on functionality restricted to that administrator. No public exploit code is identified at time of analysis, and exploitation requires both a valid console account and victim interaction.