CVE-2026-15380: Symantec Management Suite before SMA_SMP_8_8_PF_v13 and SMA_SMP_8_8_1_PF_v5

Affected technology

Symantec Management Suite · before SMA_SMP_8_8_PF_v13 and SMA_SMP_8_8_1_PF_v5
Broadcom

Description’s affected range: through a DCOM/task scheduler logic chain — no network access

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · Low privileges required · Active user interaction

What an attacker can do

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required (ITMS 8.7.3). Vendor/CNA’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality impact as high; integrity and availability impact as none.