CVE-2009-3035: The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded key that...

Security readout for executives and security teams

Symantec Altiris Notification Server 6.0.x stored a hardcoded decryption key on the server. A local user could use it to recover SQL Server and discovery credentials. If those credentials are privileged, the issue could become broader system compromise, including possible arbitrary code execution. Exposure is likely limited to legacy environments still running Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12, especially where untrusted or low-privileged users can access the Notification Server host. Treat this as a targeted legacy-platform risk. It is urgent only if the organization still runs the affected Altiris version or allows broad local access to the server. Credential theft from systems management infrastructure can have outsized operational impact. Mitigation focus: Identify any Symantec Altiris Notification Server 6.0.x deployments.; Upgrade affected systems to 6.0 SP3 R12 or later per vendor guidance.; Restrict local access to the Notification Server host..

Prepared

Jun 28, 2026, 03:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.