Windows DCOM Task Scheduler Logic Chain Allows SYSTEM Execution (ITMS 8.7.3)
CVE-2026-15380 Published on July 17, 2026

Local privilege escalation in Symantec ITMS
A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain no network access, no memory corruption required (ITMS 8.7.3)

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-15380 is exploitable with local system access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
ACTIVE

Weakness Type

Improper Privilege Management

The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.


Affected Versions

Broadcom Symantec Management Suite Version before SMA_SMP_8_8_PF_v13 and SMA_SMP_8_8_1_PF_v5 is affected by CVE-2026-15380

Exploit Probability

EPSS
0.12%
Percentile
1.94%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.