Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions o…

published 2016-06-30 10y ago modified 2026-06-17 4mo ago also EUVD-2015-8670

cvss: 2.9; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 18%
public exploits: 0; none known

Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions on USB file transfer by conducting filesystem operations before the SEP device manager recognizes a new USB device.

Is CVE-2015-8801 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	2.9	CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD	2.0	3.3	AV:L/AC:M/Au:N/C:P/I:P/A:N

Classification

Weakness

CWE-254 7PK - Security Features
CWE-284 Improper Access Control

References

symantec.com /security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628
vendor-advisory
securitytracker.com /id/1036196
vdb-entry
securityfocus.com /bid/91446
vdb-entry

Sources

CVE List CVE-2015-8801
NVD CVE-2015-8801

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.