CVE-2006-3223: Format string vulnerability in CA Integrated Threat Management (ITM), eTrust Antivirus (eAV), and eTrust Pe...

Security readout for executives and security teams

This vulnerability affects old CA security products and can crash scan jobs, with possible arbitrary code execution. The trigger is unsafe handling of format strings in a scan job description. Business urgency depends on whether any CA ITM, eTrust Antivirus, or eTrust PestPatrol r8 systems remain in use. Likely exposure is limited to environments still running the named legacy CA r8 products. Organizations with current endpoint security platforms are probably unaffected, but legacy servers, old management consoles, or unmanaged lab systems should be checked. Prioritize verification if legacy CA endpoint products may still exist. The products are old, but possible code execution in security software raises impact if exposed. If none are present, no further action is needed beyond documenting non-exposure. Mitigation focus: Inventory for CA ITM, eTrust Antivirus, and eTrust PestPatrol r8 installations.; Check CA or successor vendor guidance for fixed builds or supported migration paths.; Restrict scan job creation and modification to trusted administrators only..

Prepared

Jun 29, 2026, 11:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.