What’s Vulnerable › Vulnerabilities

CVE-2025-13919: Component Object Model (COM) Hijacking in Symantec Endpoint Protection Windows Client

• Severity: medium (CVSS 4.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-28 · updated 2026-06-17
• Weakness: CWE-427

Description

Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of issue whereby an attacker attempts to establish persistence and evade detection by hijacking COM references in the Windows Registry.

Affected products

• Broadcom Symantec Endpoint Protection Windows Client: 14.3.12154.10000

References

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36774

Get alerted when CVE-2025-13919 or the next vulnerability affects your stack