Ghost Solution Suite EUVD-2026-110619

Exploitation requires two concrete prerequisites: (1) possession of the product's hardcoded cryptographic key, which is embedded in the GSS Deployment Server software and therefore recoverable by any attacker who reverse-engineers it, and (2) access to the credential ciphertext - either by intercepting passwords transmitted by the Deployment Server (consistent with the AV:A adjacent-network vector) or by reading the encrypted domain/service-account, task run-as, and sysprep credential store from a GSS Deployment Server installation. Limiting factors: the attacker needs an adjacent-network position (not arbitrary internet-based access, per AV:A) and must be able to obtain the stored or transmitted ciphertext (reflected by the AT:P Attack Requirement); exposure is confined to environments actually running the affected GSS Deployment Server component. No end-user interaction and no authentication to the product are required (PR:N/UI:N).

This is a credential-disclosure flaw (CWE-522) in Symantec Ghost Solution Suite's GSS Deployment Server, rooted in a hardcoded cryptographic key that protects stored and transmitted domain/service account passwords, task run-as credentials, and sysprep passwords. The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N, VC:H/VI:H/VA:L) describes an adjacent-network attack of low complexity requiring no privileges, but with an explicit Attack Requirement (AT:P) - the attacker must be positioned to obtain the ciphertext (intercept transmission or read the stored blob) in addition to knowing the key. The signals pull in different directions: severity is only medium (6.8) and EPSS is very low (0.15%, 4th percentile), indicating no broad opportunistic exploitation is expected, yet the vuln.today decision label is 'this_month' and the CVSS exploit-maturity metric is set to Proof-of-Concept (E:P), implying some demonstrated exploitability. It is NOT CISA KEV-listed and no exploit reference is included in the sources. Net: this is a real but situational priority - the impact is severe where it lands (disclosure of privileged, often domain-level credentials), but exploitation is gated by adjacent-network positioning against a specialized deployment product, so it behaves as a targeted rather than mass-exploitation risk. The hardcoded-key nature means the key itself is effectively knowable to any attacker who reverse-engineers the product, so the ciphertext-access condition is the true limiting factor. Note a modest tension: EPSS/4.0-base severity read 'medium' while E:P and the 'this_month' label argue for prompt remediation - treat the decision label as the operative urgency signal.

An attacker with a foothold on the same network segment as a GSS Deployment Server extracts the hardcoded key from the product binaries, then captures credential data in transit or reads the encrypted credential/sysprep store from the installation and decrypts it. The recovered domain/service-account and run-as passwords can then be reused to move laterally and escalate within the Active Directory environment. The CVSS exploit-maturity metric is set to Proof-of-Concept (E:P), but no working exploit reference is provided in the available sources.