CVE-2015-8801: Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users t...

Security readout for executives and security teams

This issue let a local user bypass Symantec Endpoint Protection USB transfer controls by acting before the client recognized a newly attached USB device. It matters mainly where SEP device control was relied on to prevent data movement to removable media. It is not described as remote compromise or malware execution. Exposure is most likely on legacy endpoints still running Symantec Endpoint Protection 12.1 clients earlier than RU6 MP5, especially where USB device control is a data-loss prevention or compliance control. Treat as a targeted control-bypass risk, not an internet-wide emergency. Prioritize remediation if removable media restrictions support compliance, insider-risk controls, or sensitive data protection. Mitigation focus: Inventory SEP 12.1 client versions across managed endpoints.; Upgrade affected SEP clients to RU6 MP5 or later where supported.; Review Symantec guidance for any version-specific remediation details..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.