CVE-2026-15380

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation via DCOM/Task Scheduler in ITMS

Publication date: 2026-07-17

Last updated on: 2026-07-21

Assigner: Symantec Corporation

Description

A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required (ITMS 8.7.3)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-07-21

Generated

2026-08-06

AI Q&A

2026-07-17

EPSS Evaluated

2026-08-04

NVD

CVE-2026-15380

EUVD

EUVD-2026-45153

Affected Vendors & Products

Vendor	Product	Version / Range
symantec	itms	8.7.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

A non-administrator user can gain full SYSTEM code execution through a chain involving DCOM and task scheduler in ITMS 8.7.3. This requires no network access or memory corruption.

Detection Guidance

Detection methods or specific commands for this vulnerability are not provided in the available context. Manual investigation of DCOM and task scheduler configurations may be required.

Impact Analysis

An attacker with local interactive user access could escalate privileges to SYSTEM level, potentially gaining full control over the affected system.

Compliance Impact

This vulnerability allows non-administrator users to gain full SYSTEM code execution without network access or memory corruption. This could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information security) compliance if exploited.

Mitigation Strategies

Apply vendor patches or updates for ITMS 8.7.3 immediately. Restrict interactive user permissions to prevent privilege escalation. Monitor for unusual SYSTEM-level processes or task scheduler modifications.

Hi! I’m here to help you understand CVE-2026-15380. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70