Trellix vulnerabilities
We track 25 vulnerabilities in Trellix products across 25 products. 25 are rated high or critical, and none are known to be exploited. The most recent was published on November 5, 2026.
Latest Trellix vulnerabilities
- 7.1 High severity
DLP on-prem extensions: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries.
- 7.1 High severity
Trellix Network Security NX, EX, FX, AX, and CMS: Improper Control of Generation of Code
A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code using the web interface and Alert artifact details.
- 7.8 High severity
A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with…
A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver (BYOVD) was leveraged to gain access to the critic
- 7.1 High severity
System Information Reporter: Improper Link Resolution Before File Access
A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwrite system files with SIR backup files, which can potentially cause a system crash. This was achieved by adding a malicious
- 9.8 Critical severity
Trellix Enterprise Security Manager (ESM): Improper Neutralization of Special Elements used in an OS Command
A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user.
- 8.2 High severity
Trellix Enterprise Security Manager (ESM): Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing interna
- 9.8 Critical severity
Intrusion Prevention System (IPS) Manager: Deserialization of Untrusted Data
Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vulnerable Trellix IPS Manager.
- 7.5 High severity
ePolicy Orchestrator: Use of Hard-coded Credentials
Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, allowing them to access the e
- 7.8 High severity
Trellix Agent (TA): Buffer Copy without Checking Size of Input
A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause a Denial of Service (DoS), through exploiting a memory corruption issue in the TA service, which runs as root. This may a
- 7.8 High severity
Anti-Malware Engine: Improper Link Resolution Before File Access
A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local user to potentially gain an escalation of privileges. This was achieved by adding an entry to the registry under the Trell
- 7.2 High severity
ESM: Improper Neutralization of Special Elements used in a Command
An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a remote administrator to execute arbitrary code as root on the ESM. This is possible as the input isn't correctly sanitized when adding a new
- 7.2 High severity
Trellix Application and Change Control (TACC): Improper Limitation of a Pathname to a Restricted Directory
An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior to version 8.4.0 could lead to an authorised administrator attacker executing arbitrary code through up
- 8.0 High severity
ePolicy Orchestrator: Cross-Site Request Forgery
A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to successfully add a new user with administrator privileges to the ePO server. This impacts the dashboard area of the user inter
- 7.8 High severity
GetSusp: Improper Privilege Management
An Improper Privilege Management vulnerability in Trellix GetSusp prior to version 5.0.0.27 allows a local, low privilege attacker to gain access to files that usually require a higher privilege level. This is caused by GetSusp not correctly protecting a direc
- 7.8 High severity
Trellix Endpoint Security: Improper Control of Generation of Code
A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment variables, leading to denial of service and or the execution of arbitrary code.
- 7.1 High severity
Data Loss Prevention Endpoint for Windows: Incorrect Authorization
A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for which the user does not have permission to.
- 8.8 High severity
Enterprise Security Manager: Improper Neutralization of Special Elements used in an OS Command
A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). Incomplete neutralization of external commands used to control the process execution of the .zip application allows an authorized user to obtain control of the
- 7.8 High severity
Trellix Move: Unquoted Search Path or Element
An unquoted Windows search path vulnerability existed in the install the MOVE 4.10.x and earlier Windows install service (mvagtsce.exe). The misconfiguration allowed an unauthorized local user to insert arbitrary code into the unquoted service path to obtain p
- 7.8 High severity
Enterprise Security Manager: Improper Neutralization of Special Elements used in an OS Command
An OS common injection vulnerability exists in the ESM certificate API, whereby incorrectly neutralized special elements may have allowed an unauthorized user to execute system command injection for the purpose of privilege escalation or to execute arbitrary c
- 8.1 High severity
Trellix Agent: Out-of-bounds Write
A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macmnsvc process memory block, resulting in the service becoming unavailable.
- 7.8 High severity
Trellix Agent: Uncontrolled Search Path Element
A command Injection Vulnerability in TA for mac-OS prior to version 5.7.9 allows local users to place an arbitrary file into the /Library/Trellix/Agent/bin/ folder. The malicious file is executed by running the TA deployment feature located in the System Tree.
- 7.8 High severity
Trellix Agent: Improper Preservation of Permissions
A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users, during install/upgrade workflow, to replace one of the Agent’s executables before it can be executed. This allows the user to elevate their permissions.
- 8.2 High severity
Data Loss Prevention (DLP): Uncontrolled Search Path Element
The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. This allowed a local user to bypass DLP controls when uploading sensitive data from a mapped drive into a web email client. Loading from a local driver was correctly
- 7.2 High severity
Trellix IPS Manager: Improper Restriction of XML External Entity Reference
XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE attack in the administrator interface part of the interface, which allows a saved XML configuration file to be imported.
- 7.3 High severity
Trellix Agent (TA): Uncontrolled Search Path Element
A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL into the folder from where the Smart installer is being