Vulnerability scan reports Apache 2.4.68 CVEs against Symantec Endpoint Protection Manager

Products

• Endpoint Security Complete

Issue/Introduction

A third-party security or vulnerability scan flags Symantec Endpoint Protection Manager (SEPM) for multiple Common Vulnerabilities and Exposures (CVEs) resolved with Apache HTTP Server 2.4.68 and higher and Apache Commons FileUpload.

Environment

• Symantec Endpoint Protection Manager (SEPM) 14.3 RU10 and 14.4
• Microsoft Windows Server OS: All Supported Versions

Cause

SEPM utilizes Apache HTTP Server and associated third-party libraries to provide management services and client communication. Automated vulnerability scanners often trigger alerts based purely on static version banner matching rather than assessing whether specific vulnerable modules are loaded or whether existing configuration directives prevent exploitation.

Resolution

Broadcom Engineering has evaluated the Apache CVEs against SEPM 14.3 RU10 and 14.4:

1. No Impact (11 CVEs):
   • CVE-2026-29167, CVE-2026-29170, CVE-2026-34355, CVE-2026-34356, CVE-2026-42535, CVE-2026-42536, CVE-2026-44186, CVE-2026-48913, CVE-2026-49975: SEPM does not load or utilize the affected Apache modules.
   • CVE-2026-44119: SEPM is configured with AllowOverride None in httpd.conf for the root directory, which disables .htaccess file processing.
   • CVE-2026-44185: SEPM does not configure SSLOCSPEnable or SSLUseStapling in ssl.conf (these directives default to off per Apache documentation).
2. Resolved in SEPM 14.4 (1 CVE):
   • CVE-2025-48976 (Apache Commons FileUpload / AjaxSwing): AjaxSwing was replaced with WebSwing in SEPM 14.4. Our recommendation is to upgrade to SEPM 14.4 or higher.

Additional Information

The SEPM 14.5 release is tentatively scheduled for the October 2026 timeframe, but is subject to change as needed.