CVE-2026-15379
Arbitrary File Read as SYSTEM in Symantec ITMS
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user to read the contents of any file accessible to the SYSTEM account, bypassing filesystem ACLs. No admin privileges required. The provider reverts to the LocalSystem context when servicing WMI queries without re-impersonating the caller. Any local standard user can therefore read SYSTEM-readable files — including configuration files, service logs, and secrets stored with SYSTEM/Administrator-only ACLs — by querying the provider directly.
| Vendor | broadcom |
| Product | symantec it management suite |
| Ecosystems | |
| Industries | Technology |
| Published | Jul 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for broadcom symantec it management suite
Be the first to know when new unknown vulnerabilities affecting broadcom symantec it management suite are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Broadcom / Symantec IT Management Suite
8.8 8.8.1
References
Credits
Dhanush Arvind, Intercontinental Exchange (ICE) Information Security (https://www.linkedin.com/in/dagowda)