Trellix
52 CVEs across 49 Trellix products. Browse Trellix vulnerabilities, severities, and proof-of-concept exploits.
Trellix products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12588 | | 2026-07-14 | An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger d… | |
CVE-2025-7958 | | 2026-06-26 | A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code using the web inter… | |
CVE-2025-14963 | High | 7.8 | 2026-02-24 | A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges… |
CVE-2025-0664 | | 2025-07-21 | A locally authenticated, privileged user can craft a malicious OpenSSL configuration file, potentially leading the agent to load an arbitrary local library. Th… | |
CVE-2025-5967 | | 2025-07-01 | A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan Name field, resultin… | |
CVE-2025-3773 | Medium | 5.5 | 2025-06-26 | A sensitive information exposure vulnerability in System Information Reporter (SIR) 1.0.3 and prior allows an authenticated non-admin local user to extract se… |
CVE-2025-3771 | High | 7.1 | 2025-06-26 | A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwrite system files with… |
CVE-2025-3722 | Medium | 4.4 | 2025-06-26 | A path traversal vulnerability in System Information Reporter (SIR) 1.0.3 and prior allowed an authenticated high privileged user to issue malicious ePO post… |
CVE-2025-0618 | Medium | 6.5 | 2025-04-23 | A malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a specially-crafted tamper protection event t… |
CVE-2025-0617 | Medium | 5.9 | 2025-01-29 | An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger… |
CVE-2024-5955 | Medium | 5.4 | 2024-12-20 | Cross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated attacker to craft re… |
CVE-2024-9679 | Medium | 5.3 | 2024-12-16 | A Hardcoded Cryptographic key vulnerability existed in DLP Extension 11.11.1.3 which allowed the decryption of previously encrypted user credentials. |
CVE-2024-9678 | Medium | 4.9 | 2024-12-16 | An SQL Injection vulnerability existed in DLP Extension 11.11.1.3. The vulnerability allowed an attacker to perform arbitrary SQL queries potentially leading… |
CVE-2024-11482 | Critical | 9.8 | 2024-11-29 | A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, execu… |
CVE-2024-11481 | High | 8.2 | 2024-11-29 | A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwa… |
CVE-2024-5957 | Medium | 6.3 | 2024-09-05 | This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager. |
CVE-2024-5956 | Medium | 6.5 | 2024-09-05 | This vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data access to the vulnerable Trellix IPS Manager with gar… |
CVE-2024-7608 | Medium | 5.9 | 2024-08-27 | An authenticated user can access the restricted files from NX, EX, FX, AX, IVX and CMS using path traversal. |
CVE-2024-5731 | Medium | 6.8 | 2024-06-14 | A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination of a request by man… |
CVE-2024-5671 | Critical | 9.8 | 2024-06-14 | Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vul… |
CVE-2024-4176 | Medium | 4.1 | 2024-06-13 | An Cross site scripting vulnerability in the EDR XConsole before this release allowed an attacker to potentially leverage an XSS/HTML-Injection using command l… |
CVE-2024-4844 | High | 7.5 | 2024-05-16 | Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privil… |
CVE-2024-4843 | Medium | 4.3 | 2024-05-16 | ePO doesn't allow a regular privileged user to delete tasks or assignments. Insecure direct object references that allow a least privileged user to manipulate… |
CVE-2023-6072 | Medium | 4.6 | 2024-02-13 | A cross-site scripting vulnerability in Trellix Central Management (CM) prior to 9.1.3.97129 allows a remote authenticated attacker to craft CM dashboard inte… |
CVE-2024-0310 | Medium | 6.1 | 2024-01-10 | A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header param… |
CVE-2024-0213 | High | 8.2 | 2024-01-09 | A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause a Denial of Service… |
CVE-2024-0206 | High | 7.1 | 2024-01-09 | A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local user to potentially… |
CVE-2023-6071 | High | 8.4 | 2023-11-30 | An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a remote administrator to execute arbitra… |
CVE-2023-6070 | Medium | 4.3 | 2023-11-29 | A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially… |
CVE-2023-5607 | High | 8.4 | 2023-11-27 | An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior t… |
CVE-2023-5445 | Medium | 5.4 | 2023-11-17 | An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL parameter for the p… |
CVE-2023-5444 | High | 8.0 | 2023-11-17 | A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to successfully add a new u… |
CVE-2023-6119 | Medium | 6.5 | 2023-11-16 | An Improper Privilege Management vulnerability in Trellix GetSusp prior to version 5.0.0.27 allows a local, low privilege attacker to gain access to files tha… |
CVE-2023-3665 | Medium | 5.5 | 2023-10-04 | A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment va… |
CVE-2023-4814 | High | 7.1 | 2023-09-14 | A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for which the user does… |
CVE-2023-3946 | Medium | 5.4 | 2023-07-26 | A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to… |
CVE-2023-3314 | High | 8.1 | 2023-07-03 | A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). Incomplete neutralization of external commands used to co… |
CVE-2023-3438 | Medium | 4.4 | 2023-07-03 | An unquoted Windows search path vulnerability existed in the install the MOVE 4.10.x and earlier Windows install service (mvagtsce.exe). The misconfiguration… |
CVE-2023-3313 | High | 7.8 | 2023-07-03 | An OS common injection vulnerability exists in the ESM certificate API, whereby incorrectly neutralized special elements may have allowed an unauthorized user… |
CVE-2023-1388 | Medium | 6.3 | 2023-06-07 | A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macmnsvc process memory block, resulting i… |
CVE-2023-0976 | Medium | 6.3 | 2023-06-07 | A command Injection Vulnerability in TA for mac-OS prior to version 5.7.9 allows local users to place an arbitrary file into the /Library/Trellix/Agent/bin/ f… |
CVE-2023-0977 | Medium | 6.7 | 2023-04-03 | A heap-based overflow vulnerability in Trellix Agent (Windows and Linux) version 5.7.8 and earlier, allows a remote user to alter the page heap in the macmnsv… |
CVE-2023-0975 | High | 8.2 | 2023-04-03 | A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users, during install/upgrade workflow, to replace one of the… |
CVE-2023-0978 | Medium | 6.4 | 2023-03-13 | A command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlier, allows a local user to inject and execute arbitrary operatin… |
CVE-2023-0400 | Medium | 5.9 | 2023-02-02 | The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. This allowed a local user to bypass DLP controls when uploading… |
CVE-2023-0214 | Medium | 6.1 | 2023-01-18 | A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 a… |
CVE-2023-0221 | Medium | 4.4 | 2023-01-13 | Product security bypass vulnerability in ACC prior to version 8.3.4 allows a locally logged-in attacker with administrator privileges to bypass the execution c… |
CVE-2022-4326 | Medium | 5.5 | 2022-12-16 | Improper preservation of permissions vulnerability in Trellix Endpoint Agent (xAgent) prior to V35.31.22 on Windows allows a local user with administrator priv… |
CVE-2022-3859 | Medium | 6.7 | 2022-11-30 | An uncontrolled search path vulnerability exists in Trellix Agent (TA) for Windows in versions prior to 5.7.8. This allows an attacker with admin access, whic… |
CVE-2022-2188 | Medium | 6.5 | 2022-11-07 | Privilege escalation vulnerability in DXL Broker for Windows prior to 6.0.0.280 allows local users to gain elevated privileges by exploiting weak directory con… |
CVE-2022-3340 | Medium | 5.9 | 2022-11-04 | XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE attack in the admini… |
CVE-2022-3339 | Medium | 5.4 | 2022-10-18 | A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to an… |
CVE-2022-3338 | Medium | 5.4 | 2022-10-18 | An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side R… |
CVE-2022-2330 | Medium | 6.5 | 2022-08-30 | Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Age… |
CVE-2022-2313 | High | 8.2 | 2022-07-27 | A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and obtain higher privil… |