CVE-2026-101034 Security Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentials

MediumCVSS 6.8 EPSS 0.15%

Published: 2026-10-27 09:15
Updated: 2026-11-04 17:17
Exploit status: No public exploit known

Description

An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmitted by GSS Deployment Server installation.

Affected products

Product	Affected versions	Fixed in
broadcom Symantec Ghost Solution Suite	= GSS_3.3_RU11	No fix listed
broadcom Symantec Ghost Solution Suite	= GSS_3.3_RU12	No fix listed
broadcom Symantec Ghost Solution Suite	= GSS_3.3.13	No fix listed

References

support.broadcom.com vendor-advisory

CVSS v4.0

6.8 Medium

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:P/S:P/AU:Y/R:U/V:D/RE:H/U:Amber

Attack Vector: Adjacent
Attack Complexity: Low
Attack Requirements: Present
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: Low
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None
Exploit Maturity: POC
S: P
AU: Y
R: U
V: D
RE: H
U: Amber

All scores (2)

v4.0 6.8 · symantec
v4.0 6.8 · secure@symantec.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.15% (percentile 4.2)
CWE: CWE-522 Insufficiently Protected Credentials

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.