CVE-2016-3653: Multiple cross-site request forgery (CSRF) vulnerabilities in management scripts in Symantec Endpoint Prote...

Security readout for executives and security teams

This issue affects Symantec Endpoint Protection Manager 12.1 versions before RU6 MP5. A logged-in user could be manipulated through CSRF-prone management scripts, potentially letting an authenticated remote attacker hijack another user’s authentication. For executives, the concern is loss of trust in an endpoint security management platform, not confirmed widespread exploitation. Exposure is likely limited to organizations still running Symantec Endpoint Protection Manager 12.1 before RU6 MP5. Risk increases if the SEPM console is reachable from broad internal networks or by many authenticated users. Prioritize remediation for any remaining SEPM 12.1 deployment below RU6 MP5, especially if the console is broadly reachable. If SEPM has been upgraded or retired, document closure and retain evidence. Mitigation focus: Upgrade SEPM 12.1 to RU6 MP5 or later per vendor guidance.; Restrict access to the SEPM management interface to trusted administrators.; Review Symantec/Broadcom advisory guidance before applying compensating controls..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.