Is Endpoint Protection/Endpoint Protection Manager vulnerable to OpenSSL vulnerabilities ?
search cancel

Is Endpoint Protection/Endpoint Protection Manager vulnerable to OpenSSL vulnerabilities ?

book

Article ID: 428017

calendar_today

Updated On:

Products

Endpoint Protection Endpoint Security Endpoint Security Complete

Issue/Introduction

You want to know if Symantec Endpoint Protection (SEP), Symantec Endpoint Protection Manager (SEPM) are impacted by OpenSSL vulnerabilities:

- CVE-2025-11187
- CVE-2025-15467
- CVE-2025-15468
- CVE-2025-15469
- CVE-2025-66199
- CVE-2025-68160
- CVE-2025-69418
- CVE-2025-69419
- CVE-2025-69420
- CVE-2025-69421
- CVE-2026-22795
- CVE-2026-22796
- CVE-2025-11187
- CVE-2025-15467
- CVE-2025-4575
- CVE-2026-34181
- CVE-2026-34182       
- CVE-2026-34183
 
- CVE-2026-2673 
- CVE-2026-14456
- CVE-2026-75803
- CVE-2026-14457
- CVE-2026-18798
- CVE-2026-54874
- CVE-2026-63072
- CVE-2026-63073
- CVE-2026-63074
- CVE-2026-63075
- CVE-2026-63076

Resolution

SEP Windows 14.3 RU9+ uses OpenSSL 1.1.x.

  • CVE-2025-15467: No impact, because it uses earlier version OpenSSL 1.1.1x
  • CVE-2026-34181: No Impact, PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (Low) - pkcs#12 feature is unused.
  • CVE-2026-34182: No Impact, CMS AuthEnvelopedData Processing May Accept Forged Messages (Moderate) - S/MIME-like CMS is unused.
  • CVE-2026-34183: No Impact, Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (Moderate) - QUIC protocol is unused.
  • CVE-2026-2673, CVE-2026-14456, CVE-2026-75803, CVE-2026-14457, CVE-2026-18798, CVE-2026-63073, CVE-2026-63074, CVE-2026-63075, CVE-2026-63076, CVE-2026-54874  and CVE-2026-63072: No impact, the SEP Windows client does not use the impacted code path.


SEP Linux 14.3 RU9 uses OpenSSL 3.6.3

  • CVE-2026-2673: No impact, OpenSSL 3.6.2+ is not impacted
  • CVE-2026-14456: No impact, only the QIC server is impacted
  • CVE-2026-75803: No impact, SEP Linux offers ChaCha20-Poly1305 but API EVP_Cipher() is not used
  • CVE-2026-14457: No impact, RFC7250 Raw Public Keys is unused
  • CVE-2026-18798: No impact, Only the QIC server is impacted
  • CVE-2026-54874: No impact, DTLS protocol is not used.
  • CVE-2026-63072: No impact, Only the CMS (S/MIME) implementation is impacted
  • CVE-2026-63073: No impact, CMP (Certificate Management Protocol) is not used, SEP Linux only relies on SEPM to propagate certificates
  • CVE-2026-63074: No impact, CMP (Certificate Management Protocol) is not used, SEP Linux only relies on SEPM to propagate certificates.
  • CVE-2026-63075: No impact, Only the QIC server is impacted
  • CVE-2026-63076: No impact, CMP (Certificate Management Protocol) is not used, SEP Linux only relies on SEPM to propagate certificates.


SEPM 14.3 RU9 uses OpenSSL 3.1.5 while 14.3 RU10 uses OpenSSL 3.1.7, No impact for other CVE's.

  • CVE-2026-2673: No impact, TLS 1.3 is not enabled in SEPM's Apache configuration, which currently uses SSLProtocol TLSv1.2. Additionally, the OpenSSL version in use (3.1.x) predates the affected post-quantum group code, which was introduced in version 3.5+.
  • CVE-2026-14456: No impact, only the QIC server is impacted
  • CVE-2026-75803: No impact, SEPM never calls the low-level EVP_Cipher() API for ChaCha20-Poly1305/AES-OCB
  • CVE-2026-14457: No impact, RFC7250 Raw Public Keys is unused
  • CVE-2026-18798: No impact, only the QIC server is impacted
  • CVE-2026-54874: No impact, only the CMS (S/MIME) implementation is impacted
  • CVE-2026-63072: No impact, only the CMS (S/MIME) implementation is impacted
  • CVE-2026-63073: No impact, CMP (Certificate Management Protocol) is not used
  • CVE-2026-63074: No impact, CMP (Certificate Management Protocol) is not used
  • CVE-2026-63075: No impact, Only the QIC server is impacted
  • CVE-2026-63076: No impact, CMP (Certificate Management Protocol) is not used
  • CVE-2025-4575:  None of our SEPM releases is affected as this only applies to OpenSSL 3.5.
  • CVE-2025-11187:
        14.3 RU7: No impact, because SEPM uses OpenSSL 3.0.8
        14.3 RU9/RU10: No impact, because SEPM uses OpenSSL 3.1.5
  • CVE-2025-15467:
        14.3 RU7: Upgrade to 14.3 RU9 or above
        14.3 RU9/RU10: No impact, because SEPM uses OpenSSL 3.1.5

Additional Information

OpenSSL version on Endpoint Protection Manager

Powered by Wolken Software