EUVD-2026-45153
GHSA-gvhq-5mp7-wjmp
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:C/RE:M/U:Red
Local interactive session with low-privilege user required; full SYSTEM execution warrants high C/I/A, correcting the vendor's VC:H-only impact claim.
Primary rating from Vendor (symantec).
CVSS VectorVendor: symantec
Lifecycle Timeline
1DescriptionCVE.org
A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain - no network access, no memory corruption required (ITMS 8.7.3)
AnalysisAI
Full SYSTEM-level code execution in Broadcom's Symantec IT Management Suite (ITMS) 8.7.3 is reachable by any non-administrator interactive user via a DCOM and Windows Task Scheduler logic chain, requiring no network access and no memory corruption. The attack is confined to the local host, meaning a standard user account with an interactive session on the ITMS server is sufficient to achieve unrestricted SYSTEM privileges. No public exploit has been identified at time of analysis, though Broadcom's advisory carries the highest urgency rating (U:Red) and the CVSS 4.0 supplemental metric AU:Y indicates the exploitation steps can be automated once understood.
Technical ContextAI
Symantec IT Management Suite (ITMS) is Broadcom's enterprise endpoint management and software delivery platform, identified by CPE cpe:2.3:a:broadcom:symantec_management_suite:*:*:*:*:*:*:*:*. The vulnerability is a logic flaw - explicitly not a memory corruption issue - involving the Windows DCOM (Distributed Component Object Model) subsystem and the Windows Task Scheduler service as exposed or consumed by ITMS components. DCOM and task scheduler privilege escalation chains typically exploit improperly secured COM server registrations, task definition permissions, or scheduler API calls that allow a low-privileged process to trigger high-privileged task execution without overwriting memory. No CWE has been assigned, which is consistent with a design or authorization logic flaw that does not map cleanly to a single weakness class. Notably, the 'Buffer Overflow' tag in the source intelligence directly contradicts the description's explicit claim that no memory corruption is required - this tag appears to be erroneous metadata and should not be relied upon for triage.
RemediationAI
Consult Broadcom Security Advisory ID 37995 at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37995 for the official patch or hotfix targeting ITMS 8.7.3; the exact patched release version is not independently confirmed from the available data, so the advisory is the authoritative source for upgrade targets. As an immediate compensating control, restrict interactive logon rights on ITMS management servers to dedicated administrator accounts only, using Group Policy User Rights Assignment settings 'Allow log on locally' and 'Allow log on through Remote Desktop Services' - this removes the non-admin interactive session prerequisite and fully blocks this specific attack path, though it may prevent helpdesk or analyst staff from directly accessing the ITMS console and should be evaluated against operational requirements. Additionally, audit Windows Task Scheduler event logs (Microsoft-Windows-TaskScheduler, Event IDs 106, 129, 200, 201) and DCOM activation logs for anomalous task registration or COM server activation by standard user accounts as a detection measure.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today