CVE-2004-2622: AClient.exe in Altiris Deployment Solution 6.x and 5.x does not require authentication from the first Deplo...

Security readout for executives and security teams

This CVE concerns legacy Altiris Deployment Solution clients. The client may trust the first Deployment Server it connects to without authentication, allowing a malicious server to obtain administrator access. The main risk is control over managed endpoints through the deployment system, not ordinary website compromise. Exposure is most likely in organizations still running Altiris Deployment Solution 5.x or 6.x with AClient.exe on endpoints. Retired environments, upgraded platforms, or systems without AClient.exe are less likely exposed. The provided affected-product metadata is incomplete, so asset validation is required. Prioritize if legacy Altiris deployment infrastructure remains in use. The issue can affect administrative control of endpoints, but urgency depends on confirmed presence of AClient.exe and reachable deployment networks. If the product is retired, document evidence and close as not applicable. Mitigation focus: Inventory Altiris Deployment Solution 5.x/6.x and AClient.exe installations.; Check vendor or successor product guidance for supported updates or migration paths.; Restrict deployment client traffic to trusted management networks..

Prepared

Jun 29, 2026, 16:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.