CVE-2026-101034

Security Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentials

State: Published
Severity: 6.8 Medium
Published: Oct 27, 2026
Updated: Oct 27, 2026
Reserved: Sep 27, 2026

Description

An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmitted by GSS Deployment Server installation.

Scores

CVSS	Score	Vector	Source
4.0	6.8 Medium	CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:P/S:P/AU:Y/R:U/V:D/RE:H/U:Amber	symantec

Weaknesses

CWE-522 Insufficiently Protected Credentials

Affected Products

Product	Versions
Symantec Ghost Solution SuiteBroadcom	GSS_3.3_RU11Affected GSS_3.3_RU12Affected GSS_3.3.13Affected

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39440vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.