CVE-2015-8799: Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System P...

Security readout for executives and security teams

This flaw lets a logged-in remote user abuse a directory traversal issue in Symantec management server components to write update-package data to arbitrary agent locations. For organizations using these legacy Symantec endpoint or data center protection products, the concern is unauthorized modification of managed agent content. Exposure is likely limited to organizations still running affected Symantec SES:CSP, SCSP, or DCS:SA management servers and agents. Internet exposure is not established in the sources; the attacker must be authenticated remotely. Prioritize remediation if these legacy Symantec management servers remain in production, especially where many agents are centrally managed. The issue requires authentication, but arbitrary writes to agent locations can create operational and security risk across managed systems. Mitigation focus: Check Symantec/Broadcom advisory guidance for the exact maintained upgrade path.; Upgrade affected SES:CSP, SCSP, and DCS:SA deployments to the named maintenance packs or later.; Restrict management server access to trusted administrative networks and users..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.