CVE-2013-4676: Multiple cross-site scripting (XSS) vulnerabilities in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and...

Security readout for executives and security teams

This CVE covers multiple cross-site scripting flaws in Symantec Backup Exec admin interfaces. If an attacker can reach affected console pages, they may inject browser script or HTML that runs when a user views it. The business risk is strongest where old Backup Exec consoles remain reachable by administrators or internal users. Exposure is likely limited to organizations still running legacy Backup Exec 2010 R3 or 2012, especially where management or beutility consoles are reachable beyond tightly controlled admin networks. Treat this as a legacy-platform cleanup item unless the consoles are internet-exposed or broadly reachable internally. Prioritize patching or retiring affected Backup Exec versions because backup administration systems have high operational importance. Mitigation focus: Upgrade Backup Exec 2010 R3 to SP3 or later.; Upgrade Backup Exec 2012 to SP2 or later.; Restrict Backup Exec console access to trusted admin networks..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.