CVE-2016-6590

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-08 · updated 2026-06-17
Weakness: CWE-269

Description

A privilege escalation vulnerability exists when loading DLLs during boot up and reboot in Symantec IT Management Suite 8.0 prior to 8.0 HF4 and Suite 7.6 prior to 7.6 HF7, Symantec Ghost Solution Suite 3.1 prior to 3.1 MP4, Symantec Endpoint Virtualization 7.x prior to 7.6 HF7, and Symantec Encryption Desktop 10.x prior to 10.4.1, which could let a local malicious user execute arbitrary code.

Affected products

Symantec Corporation Symantec Encryption Desktop: from 10.0.0 before 10.4.1 — fixed in 10.4.1
Symantec Corporation Symantec Endpoint Encryption: from 7.0 before 7.6; 7.6 — fixed in 7.6
Symantec Ghost Solution Suite: 3.1, 3.1-maintenance_pack1, 3.1-maintenance_pack2, 3.1-maintenance_pack3
Symantec IT Management Suite: 7.6, 8.0

How to fix

Upgrade to a fixed version: Symantec Corporation Symantec Encryption Desktop 10.4.1; Symantec Corporation Symantec Endpoint Encryption 7.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2016-6590 or the next vulnerability affects your stack