CVE-2026-3991Disclosure

Another Security Agent, another Local Privilege Escalation! CVE-2026-3991: Symantec DLP Agent for Windows is affected by an LPE via a hardcoded OpenSSL configuration path. An easy way to get a SYSTEM shell directly into the DLP process. by @p0w1_ https://labs.infoguard.ch/advisories/cve-2026-3991_symantec-dlp-agent_local-privilege-escalation/

Symantec DLP Agent の脆弱性 CVE-2026-3991 が FIX：SYSTEM 権限奪取の可能性 https://iototsecnews.jp/2026/04/02/symantec-dlp-agent-flaw-exposed-systems-to-privilege-escalation-attacks/ 脆弱性 CVE-2026-3991 は、最終的な製品内に、開発時の古いファイルパスが残ってしまったことに起因します。本来は存在しないはずのパスを、プログラムが探しに行ってしまうという問題を突く攻撃者は、そこに偽のコンフィグ・ファイルを置くことで SYSTEM 権限の奪取が可能になります。”edpa.exe” という重要なプロセスが、外部のファイルを無条件に信じて読み込んでしまう設計上のミスが、深刻なリスクにつながっています。ご利用のチームは、ご注意ください。 #CVE20263991 #DataLossPreventionAgent #Symantec #Vulnerability

⚠️ Vulnerabilidad en productos Broadcom ❗ CVE-2026-3991 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-productos-broadcom-2/ https://t.co/mXzWZpAFLe

BREAKING: Critical Symantec DLP Agent for Windows bug CVE-2026-3991 allows local privilege escalation to SYSTEM, CVSS 7.8, with Broadcom patches released March 30 2026. https://threatcluster.io/cluster/critical-symantec-dlp-agent-vulnerability-enables-privilege--62b5dc1a

Symantec DLP Agent Vulnerability Let Attackers Escalate Privileges https://ift.tt/6ny2phO A high-severity security flaw has been identified in the Symantec Data Loss Prevention (DLP) Agent for Windows. Tracked as CVE-2026-3991, this vulnerability allows a low-privileged loca…

⚠️ **Vulnerability Alert:** Local Privilege Esccalation in Symantec DLP Agent for Windows (CVE-2026-3991) 📅 **Timeline:** Disclosure: 2026-03-30; Patch: 2026-03-30 🆔 **CVE-2026-3991** | 📊 CVSS: 7.8 (HIGH 🟠) | 📈 EPSS: 2.04% 🛠️ **Exploit Maturity:** Publicly disclosed; patches available (2026-03-30) 📂 **Affected Versions:** Prior to 25.1 MP1, Prior to 16.1 MP2, Prior to 16.0 RU2 HF9, Prior to 16.0 RU1 MP1 HF12, Prior to 16.0 MP2 HF15 🔧 **Fixed Versions:** DLP 25.1 MP1, DLP 16.1 MP2, DLP 16.0 RU2 HF9, DLP 16.0 RU1 MP1 HF12, DLP 16.0 MP2 HF15 🫨 **Attack Vectors:** - Local authenticated user creates C:\VontuDev\ and supplies malicious openssl.cnf to trigger DLL side-load. - SYSTEM-run edpa.exe loads attacker-supplied DLL, enabling local privilege escalation. 📝 **Summary:** An authenticated local user can create a missing OpenSSL config path (C:\VontuDev\), drop a crafted openssl.cnf and rogue DLL, and cause the SYSTEM process edpa.exe to load it, yielding SYSTEM-level code execution. This enables persistent backdoors, EDR evasion, lateral movement and enterprise-wide data exfiltration — patch immediately. 📈 **Impact Scope:** SYSTEM-level code execution on affected endpoints; potential persistent backdoors, EDR/telemetry evasion, lateral movement and data exfiltration across enterprise networks. 🛡️ **Recommended Actions:** - Apply Broadcom official patches immediately (upgrade to listed fixed versions). - Inventory DLP agent versions and prioritize remediation for unpatched hosts. 🪢 **Related Resources:** - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37306 - https://labs.infoguard.ch/advisories/cve-2026-3991_symantec-dlp-agent_local-privilege-escalation/ 🏷 **Tags:** #Cybersecurity #SymantecDLP #PrivilegeEscalation

⚠️ **Vulnerability Alert:** Symantec Data Loss Prevention (DLP) Agent Local Privilege Escalation (CVE-2026-3991) 📅 **Timeline:** Disclosure: 2026-03-30 🆔 **CVE-2026-3991** | 📊 CVSS: 7.8 (HIGH 🟠) | 📈 EPSS: 2.038% 🛠️ **Exploit Maturity:** Not Available 📂 **Affected Versions:** Prior to 25.1 MP1, Prior to 16.1 MP2, Prior to 16.0 RU2 HF9, Prior to 16.0 RU1 MP1 HF12, Prior to 16.0 MP2 HF15 🔧 **Fixed Versions:** 25.1 MP1, 16.1 MP2, 16.0 RU2 HF9, 16.0 RU1 MP1 HF12, 16.0 MP2 HF15 🫨 **Attack Vectors:** - Local access required (AV:L) - Low attack complexity (AC:L) - Privileges required: Low (PR:L) - No user interaction (UI:N) 📝 **Summary:** CVE-2026-3991 is a local privilege escalation in Symantec DLP Agent for Windows that allows a low-privileged local user to gain elevated/system privileges and execute code with high impact to confidentiality, integrity, and availability. An attacker could access or exfiltrate DLP-protected data, install persistent malware, or disable security controls on affected endpoints. 📈 **Impact Scope:** Local low-privilege attacker can escalate to elevated/system privileges, execute code with elevated privileges, access or exfiltrate data protected by the DLP product, install persistent malware, or disable security controls on affected Windows endpoints. 🛡️ **Recommended Actions:** - Apply vendor updates to the fixed versions listed immediately. - Restrict local access and enforce least-privilege user rights on endpoints. - Monitor endpoints for suspicious process creation, privilege escalation activity, and DLP agent tampering. - Deploy or tune EDR/IDS detections and validate patches in staging before wide deployment. 🪢 **Related Resources:** - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37306 - https://nvd.nist.gov/vuln/detail/CVE-2026-3991 🏷 **Tags:** #Cybersecurity #SymantecDLP #PrivilegeEscalation

⚠️ **Vulnerability Alert:** Symantec Data Loss Prevention (DLP) Agent Local Privilege Escalation (CVE-2026-3991) 📅 **Timeline:** Disclosure: 2026-03-30; Patch: Not Available 🆔 **CVE-2026-3991** | 📊 CVSS: 7.8 (High 🟠) | 📈 EPSS: 2.038% 🛠️ **Exploit Maturity:** Not Available 📂 **Affected Versions:** Symantec DLP Windows Endpoint prior to 25.1 MP1, prior to 16.1 MP2, prior to 16.0 RU2 HF9, prior to 16.0 RU1 MP1 HF12, prior to 16.0 MP2 HF15 🔧 **Fixed Versions:** 25.1 MP1, 16.1 MP2, 16.0 RU2 HF9, 16.0 RU1 MP1 HF12, 16.0 MP2 HF15 🫨 **Attack Vectors:** - Local (requires low privileges; no user interaction) 📝 **Summary:** A local privilege escalation in Symantec DLP Windows Endpoint (CVE-2026-3991) lets a low-privileged local user elevate to SYSTEM. Successful exploitation can disable security controls, expose sensitive data, install persistent backdoors, and enable lateral movement or full host compromise. 📈 **Impact Scope:** Local low-privilege user can escalate to SYSTEM on affected Windows endpoints — high impact on confidentiality, integrity, and availability; potential for persistent full-host compromise and lateral movement. 🛡️ **Recommended Actions:** - Apply vendor updates to affected agents (install 25.1 MP1, 16.1 MP2, 16.0 RU2 HF9, 16.0 RU1 MP1 HF12, or 16.0 MP2 HF15 as applicable) - If immediate patching isn't possible, restrict local access and remove unnecessary local admin rights - Audit endpoints for signs of privilege escalation and anomalous service/config changes - Verify/enable EDR and monitor for suspicious process/service installations - Harden hosts, enforce least privilege, and rotate credentials/keys if compromise is suspected 🪢 **Related Resources:** - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37306 - https://gbhackers.com/symantec-dlp-agent-flaw/ 🏷 **Tags:** #Cybersecurity #SymantecDLP #PrivilegeEscalation

『may be susceptible to an Elevation of Privilege vulnerability,』 CVE-2026-3991 Symantec Data Loss Prevention Security Update https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37306

🚨*CVE* CVE-2026-3991 Symantec Data Loss Prevention Windows Endpoint, prior to 25.1 MP1, 16.1 MP2, 16.0 RU2 HF9, 16.0 RU1 MP1 HF12, and 16.0 MP2 HF15, may be susceptible to a Elevation of Pr… https://www.cve.org/CVERecord?id=CVE-2026-3991 ----- Traducción: CVE-2026-3991 Sym… http://infoflow.cloud`

CVE-2026-3991 Symantec Data Loss Prevention Windows Endpoint, prior to 25.1 MP1, 16.1 MP2, 16.0 RU2 HF9, 16.0 RU1 MP1 HF12, and 16.0 MP2 HF15, may be susceptible to a Elevation of Pr… https://www.cve.org/CVERecord?id=CVE-2026-3991