Vulnerability · Published Jul 17, 2026 · Assigned by symantec
CVE-2026-15380Local privilege escalation in Symantec ITMS
Medium 5.1
In plain English
A medium-severity privilege mismanagement in Symantec Management Suite from Broadcom. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 4.0)5.1Medium
Exploit odds (30 days)0.2%top 93.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required (ITMS 8.7.3)
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Broadcom | Symantec Management Suite | before SMA_SMP_8_8_PF_v13 and SMA_SMP_8_8_1_PF_v5 |
Weakness: CWE-269 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:A/V:C/RE:M/U:Red