Symantec Management Suite EUVD-2026-45153

Exploitation requires an interactive user session - local console or Remote Desktop (RDP) - on the Windows host running ITMS 8.7.3, held by a non-administrator account. The CVSS 4.0 UI:A metric indicates the attacker must actively perform some operation beyond merely being logged in, though the exact triggering action is not disclosed in available public data. The attack is entirely local (AV:L); no network connectivity to or from a remote attacker-controlled system is involved in the exploit chain itself. Limiting factors are: (1) the attacker must hold an interactive session on the ITMS server itself, not just any host on the network; (2) a Group Policy restriction of interactive logon to administrators only would fully eliminate this attack path; (3) the vulnerability is explicitly tied to ITMS 8.7.3 and may not affect other versions. There is no remote unauthenticated exploitation path for this vulnerability.

The CVSS 4.0 base score of 5.1 (Medium) materially understates the real-world significance of SYSTEM-level privilege escalation from a standard user account. The local attack vector (AV:L) and user interaction requirement (UI:A) limit exposure to hosts where non-trusted users can obtain interactive sessions - console or RDP - on the ITMS management server, which is a meaningful but not negligible constraint in enterprise environments. The CVSS 4.0 supplemental metrics tell a more urgent story: U:Red (highest urgency tier), V:C (concentrated value - ITMS manages endpoints across an enterprise), and AU:Y (attack steps are automatable). The vendor's impact assessment of VC:H/VI:N/VA:N is inconsistent with 'full SYSTEM code execution,' which by definition grants arbitrary write and process control, implying high integrity and availability impact as well - this discrepancy should be confirmed against the Broadcom advisory. EPSS data is not provided in the available intelligence, and this CVE does not appear in CISA KEV. Because the technique is logic-based with no memory corruption, it is likely reliable and unaffected by DEP, ASLR, or CFG mitigations, raising the practical exploitability above what CVSS base score alone suggests.

An attacker who has obtained a standard non-administrator Windows account on the ITMS 8.7.3 management server - via credential theft, phishing, or lateral movement from another host - establishes an interactive session through RDP. By invoking a crafted DCOM call or manipulating a task scheduler registration exposed by an ITMS service component, the attacker triggers the logic chain that causes code to execute under the SYSTEM account, granting unrestricted access to the host and, by extension, to the endpoint management infrastructure it controls. No public exploit code is known at time of analysis, but the AU:Y supplemental metric indicates the technique is automatable.