# cve.now: Trellix

The newest entries naming Trellix as an affected vendor (up to 200), of 58 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115740](https://cve.now/CVE-2026-115740.md): Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix… (CVSS 5.3)
- [CVE-2026-115739](https://cve.now/CVE-2026-115739.md): Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to… (CVSS 6.0)
- [CVE-2026-115738](https://cve.now/CVE-2026-115738.md): SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL… (CVSS 7.1)
- [CVE-2026-107171](https://cve.now/CVE-2026-107171.md): An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users. (CVSS 6.9)
- [CVE-2026-12588](https://cve.now/CVE-2026-12588.md): An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. (CVSS 6.0)
- [CVE-2025-7958](https://cve.now/CVE-2025-7958.md): A Code Injection vulnerability existed in Trellix Network Security CM and NX. (CVSS 7.1)
- [CVE-2025-14963](https://cve.now/CVE-2025-14963.md): A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated (CVSS 6.2)
- [CVE-2025-0664](https://cve.now/CVE-2025-0664.md): A locally authenticated, privileged user can craft a malicious OpenSSL configuration file, potentially leading the agent to load an arbitrar (CVSS 6.7)
- [CVE-2025-5967](https://cve.now/CVE-2025-5967.md): A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan N (CVSS 5.3)
- [CVE-2025-3773](https://cve.now/CVE-2025-3773.md): A sensitive information exposure vulnerability in System Information Reporter (SIR) 1.0.3 and prior allows an authenticated non-admin local (CVSS 0.0)
- [CVE-2025-3722](https://cve.now/CVE-2025-3722.md): A path traversal vulnerability in System Information Reporter (SIR) 1.0.3 and prior allowed an authenticated high privileged user to issue (CVSS 0.0)
- [CVE-2025-3771](https://cve.now/CVE-2025-3771.md): A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwrite (CVSS 7.2)
- [CVE-2025-0618](https://cve.now/CVE-2025-0618.md): A malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a specially-crafted tamper (CVSS 6.5)
- [CVE-2025-0617](https://cve.now/CVE-2025-0617.md): An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. (CVSS 5.9)
- [CVE-2024-5955](https://cve.now/CVE-2024-5955.md): Cross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated a (CVSS 5.4)
- [CVE-2024-9679](https://cve.now/CVE-2024-9679.md): A Hardcoded Cryptographic key vulnerability existed in DLP Extension 11.11.1.3 which allowed the decryption of previously encrypted user cre (CVSS 5.3)
- [CVE-2024-9678](https://cve.now/CVE-2024-9678.md): An SQL Injection vulnerability existed in DLP Extension 11.11.1.3. (CVSS 4.9)
- [CVE-2024-11482](https://cve.now/CVE-2024-11482.md): A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through comma (CVSS 9.8)
- [CVE-2024-11481](https://cve.now/CVE-2024-11481.md): A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. (CVSS 8.2)
- [CVE-2024-5957](https://cve.now/CVE-2024-5957.md): This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager. (CVSS 6.3)
- [CVE-2024-5956](https://cve.now/CVE-2024-5956.md): This vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data access to the vulnerable Trellix I (CVSS 6.5)
- [CVE-2024-7608](https://cve.now/CVE-2024-7608.md): An authenticated user can access the restricted files from NX, EX, FX, AX, IVX and CMS using path traversal. (CVSS 5.9)
- [CVE-2024-5731](https://cve.now/CVE-2024-5731.md): A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination (CVSS 6.8)
- [CVE-2024-5671](https://cve.now/CVE-2024-5671.md): Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution an (CVSS 9.8)
- [CVE-2024-4176](https://cve.now/CVE-2024-4176.md): An Cross site scripting vulnerability in the EDR XConsole before this release allowed an attacker to potentially leverage an XSS/HTML-Inject (CVSS 4.1)
- [CVE-2024-4844](https://cve.now/CVE-2024-4844.md): Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacke (CVSS 7.5)
- [CVE-2024-4843](https://cve.now/CVE-2024-4843.md): ePO doesn't allow a regular privileged user to delete tasks or assignments. (CVSS 4.3)
- [CVE-2023-6072](https://cve.now/CVE-2023-6072.md): A cross-site scripting vulnerability in Trellix Central Management (CM) prior to 9.1.3.97129 allows a remote authenticated attacker to craf (CVSS 4.6)
- [CVE-2024-0310](https://cve.now/CVE-2024-0310.md): A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the re (CVSS 6.1)
- [CVE-2024-0213](https://cve.now/CVE-2024-0213.md): A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause (CVSS 8.2)
- [CVE-2024-0206](https://cve.now/CVE-2024-0206.md): A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local u (CVSS 7.1)
- [CVE-2023-6071](https://cve.now/CVE-2023-6071.md): An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a remote administrator (CVSS 8.4)
- [CVE-2023-6070](https://cve.now/CVE-2023-6070.md): A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary c (CVSS 4.3)
- [CVE-2023-5607](https://cve.now/CVE-2023-5607.md): An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises e (CVSS 8.4)
- [CVE-2023-5445](https://cve.now/CVE-2023-5445.md): An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL (CVSS 5.4)
- [CVE-2023-5444](https://cve.now/CVE-2023-5444.md): CSRF in ePO leading to privilege escalation (CVSS 8.0)
- [CVE-2023-6119](https://cve.now/CVE-2023-6119.md): An Improper Privilege Management vulnerability in Trellix GetSusp prior to version 5.0.0.27 allows a local, low privilege attacker to gain (CVSS 6.5)
- [CVE-2023-3665](https://cve.now/CVE-2023-3665.md): A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component (CVSS 5.5)
- [CVE-2023-4814](https://cve.now/CVE-2023-4814.md): A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for w (CVSS 7.1)
- [CVE-2023-3946](https://cve.now/CVE-2023-3946.md): A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potential (CVSS 5.4)
- [CVE-2023-3314](https://cve.now/CVE-2023-3314.md): A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). (CVSS 8.1)
- [CVE-2023-3313](https://cve.now/CVE-2023-3313.md): An OS common injection vulnerability exists in the ESM certificate API, whereby incorrectly neutralized special elements may have allowed a (CVSS 7.8)
- [CVE-2023-3438](https://cve.now/CVE-2023-3438.md): An unquoted Windows search path vulnerability existed in the install the MOVE 4.10.x and earlier Windows install service (mvagtsce.exe). (CVSS 4.4)
- [CVE-2023-0976](https://cve.now/CVE-2023-0976.md): A command Injection Vulnerability in TA for mac-OS prior to version 5.7.9 allows local users to place an arbitrary file into the /Library/T (CVSS 6.3)
- [CVE-2023-1388](https://cve.now/CVE-2023-1388.md): A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macmnsvc process memory (CVSS 6.3)
- [CVE-2023-0977](https://cve.now/CVE-2023-0977.md): A heap-based overflow vulnerability in Trellix Agent (Windows and Linux) version 5.7.8 and earlier, allows a remote user to alter the page (CVSS 6.7)
- [CVE-2023-0975](https://cve.now/CVE-2023-0975.md): A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users, during install/upgrade workflow, to (CVSS 8.2)
- [CVE-2023-0978](https://cve.now/CVE-2023-0978.md): A command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlier, allows a local user to inject and execute (CVSS 6.4)
- [CVE-2023-0400](https://cve.now/CVE-2023-0400.md): The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. (CVSS 5.9)
- [CVE-2023-0221](https://cve.now/CVE-2023-0221.md): Product security bypass vulnerability in ACC prior to version 8.3.4 allows a locally logged-in attacker with administrator privileges to byp (CVSS 4.4)
- [CVE-2022-4326](https://cve.now/CVE-2022-4326.md): Trellix xAgent permission bypass vulnerability (CVSS 5.5)
- [CVE-2022-3859](https://cve.now/CVE-2022-3859.md): An uncontrolled search path vulnerability exists in Trellix Agent (TA) for Windows in versions prior to 5.7.8. (CVSS 6.7)
- [CVE-2022-2188](https://cve.now/CVE-2022-2188.md): DXL Broker privilege escalation vulnerability (CVSS 6.5)
- [CVE-2022-3340](https://cve.now/CVE-2022-3340.md): Trellix IPS Manager vulnerable to XXE (CVSS 5.9)
- [CVE-2022-3339](https://cve.now/CVE-2022-3339.md): Reflected XSS in Trellix ePO server (CVSS 5.4)
- [CVE-2022-3338](https://cve.now/CVE-2022-3338.md): XXE in Trellix ePO server (CVSS 5.4)
- [CVE-2022-2330](https://cve.now/CVE-2022-2330.md): XXE vulnerability in DLP Endpoint for Windows (CVSS 6.5)
- [CVE-2022-2313](https://cve.now/CVE-2022-2313.md): DLL high jacking in Trellix Agent (CVSS 8.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/trellix
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.