CVE-2026-15379

Medium

Description

The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user to read the contents of any file accessible to the SYSTEM account, bypassing filesystem ACLs. No admin privileges required. The provider reverts to the LocalSystem context when servicing WMI queries without re-impersonating the caller. Any local standard user can therefore read SYSTEM-readable files — including configuration files, service logs, and secrets stored with SYSTEM/Administrator-only ACLs — by querying the provider directly.

SeverityMedium

CVSS5.1

Exploit probability—

Product

Symantec IT Management Suite

PublishedJul 17, 2026

First seenJul 17, 2026

Weakness typeCWE-269Improper privilege management

How to fix

Vendor advisories

support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37995

Affected products

Product	Affected versions	Fixed in
Broadcom Symantec IT Management Suite	before SMA_SMP_8_8_PF_v13 and SMA_SMP_8_8_1_PF_v5	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.