CVE-2014-7287: The key-management component in Symantec PGP Universal Server and Encryption Management Server before 3.3.2...

Security readout for executives and security teams

This vulnerability affects legacy Symantec PGP Universal Server and Encryption Management Server versions before 3.3.2 MP7. A remote sender could craft key identity data in an inbound email so the server places unintended content into outbound email, including the Subject header. The main business risk is trusted security infrastructure sending misleading or manipulated email. Exposure is likely limited to organizations still operating Symantec PGP Universal Server or Encryption Management Server before 3.3.2 MP7, especially where inbound email can reach key-management workflows and outbound notification or key-related email is enabled. Treat as a legacy platform hygiene issue with moderate urgency. Prioritize remediation if the product still processes external inbound email, because compromised email integrity from a trusted encryption system can create operational and reputational risk. Mitigation focus: Upgrade affected systems to Symantec 3.3.2 MP7 or later if still deployed.; Review Symantec advisory guidance before applying changes in production.; Restrict inbound mail paths to key-management services where operationally possible..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.