Vulnerability · Published Oct 27, 2026 · Assigned by symantec
CVE-2026-101034Security Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentials
Medium 6.8
In plain English
A medium-severity security flaw in Symantec Ghost Solution Suite from Broadcom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Severity (CVSS 4.0)6.8Medium
Exploit odds (30 days)0.1%top 95.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmitted by GSS Deployment Server installation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Broadcom | Symantec Ghost Solution Suite | GSS_3.3_RU11GSS_3.3_RU12GSS_3.3.13 |
Weakness: CWE-522 · Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:P/S:P/AU:Y/R:U/V:D/RE:H/U:Amber