Changeflow GovPing Data Privacy & Cybersecurity Symantec DLP Privilege Escalation Vulnerability
Priority review Notice Added Final

Symantec DLP Privilege Escalation Vulnerability

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published March 31st, 2026
Detected March 31st, 2026
Email

Summary

CERT-FR published a security advisory warning of a privilege escalation vulnerability (CVE-2026-3991) in Symantec Data Loss Prevention affecting five version branches: 16.0 MP2, 16.0 RU1 MP1, 16.0 RU2, 16.1 MP2, and 25.1 MP1. Broadcom released security bulletin 37306 with patches. Organizations using affected versions should update immediately.

View original document View source feed page

What changed

CERT-FR issued an advisory identifying a privilege escalation vulnerability in Symantec DLP (CVE-2026-3991) discovered in Broadcom's security bulletin 37306 dated March 30, 2026. The vulnerability affects five specific version branches: versions prior to 16.0 MP2 HF15 (16.0.00215.62094), 16.0 RU1 MP1 HF12 (16.0.10112.60928), 16.0 RU2 HF9 (16.0.20009.60689), 16.1 MP2 (16.1.00200.60431), and 25.1 MP1 (25.1.00100.60229).

Organizations running any affected version of Symantec DLP should identify their current version, download the appropriate patch from Broadcom support portal (bulletin 37306), and apply the update. No specific compliance deadline is stated, but immediate patching is recommended given the privilege escalation risk.

What to do next

  1. Identify current Symantec DLP version by checking About/version information
  2. Download patch from Broadcom Security Bulletin 37306 at support.broadcom.com
  3. Apply the appropriate patch for your version branch (16.0 MP2 HF15, 16.0 RU1 MP1 HF12, 16.0 RU2 HF9, 16.1 MP2, or 25.1 MP1)

Source document (simplified)

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 31 mars 2026 N° CERTFR-2026-AVI-0378 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Vulnérabilité dans Symantec Data Loss Prevention (DLP)

Gestion du document

| Référence | CERTFR-2026-AVI-0378 |
| Titre | Vulnérabilité dans Symantec Data Loss Prevention (DLP) |
| Date de la première version | 31 mars 2026 |
| Date de la dernière version | 31 mars 2026 |
| Source(s) | Bulletin de sécurité Symantec 37306 du 30 mars 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risque

  • Élévation de privilèges

Systèmes affectés

  • Data Loss Prevention (DLP) versions antérieures à 16.0 MP2 HF15 (16.0.00215.62094)
  • Data Loss Prevention (DLP) versions antérieures à 16.0 RU1 MP1 HF12 (16.0.10112.60928)
  • Data Loss Prevention (DLP) versions antérieures à 16.0 RU2 HF9 (16.0.20009.60689)
  • Data Loss Prevention (DLP) versions antérieures à 16.1 MP2 (16.1.00200.60431)
  • Data Loss Prevention (DLP) versions antérieures à 25.1 MP1 (25.1.00100.60229)

Résumé

Une vulnérabilité a été découverte dans Symantec Data Loss Prevention (DLP). Elle permet à un attaquant de provoquer une élévation de privilèges.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 31 mars 2026 Version initiale

Related changes

Favicon for www.cert.ssi.gouv.fr Elastic OpenTelemetry Java Remote Code Execution Vulnerability
Urgent Mar 31, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Edge Vulnerabilities Prior to 146.0.3856.84
Routine Mar 31, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Papercut Vulnerabilities Expose Data Confidentiality, Enable Remote XSS
Priority review Mar 31, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for changeflow.com Zero-Trust Policy Generation via Application Segmentation
Routine Mar 31, 2026 • ChangeBridge: Patent Grants - Networking (H04L) • Telecom & Technology
Favicon for www.cisa.gov Critical Authentication Bypass in PX4 Autopilot MAVLink Protocol
Urgent Mar 31, 2026 • CISA ICS-CERT Advisories • Data Privacy & Cybersecurity
Favicon for www.cisa.gov Critical Authentication Bypass Vulnerability in Anritsu Remote Spectrum Monitor
Urgent Mar 31, 2026 • CISA ICS-CERT Advisories • Data Privacy & Cybersecurity

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity
Analysis generated by AI. Source diff and links are from the original.

Classification

Agency
CERT-FR
Published
March 31st, 2026
Instrument
Notice
Legal weight
Non-binding
Stage
Final
Change scope
Minor
Document ID
CERTFR-2026-AVI-0378

Who this affects

Applies to
Technology companies
Industry sector
5112 Software & Technology
Activity scope
Software Vulnerability Management
Threshold
Organizations running Symantec Data Loss Prevention versions prior to those specified in affected versions list
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Topics
Data Privacy Software Security

Browse Categories

Agriculture & Food Safety 63 AI Regulation 3 Banking & Finance 266 Consumer & Competition 1 Consumer Protection 44 Courts & Legal 360 Data Privacy & Cybersecurity 74 Defense & National Security 52 Education 20 Energy 107 Environment 85 Government & Legislation 327 Healthcare 136 Housing 16 Immigration 9 Insurance 58 Labor & Employment 114 Legal & Courts 1 Pharma & Drug Safety 103 Securities & Markets 104 Tax 65 Tax & Revenue 1 Telecom & Technology 47 Trade & Sanctions 124 Transportation 57

Get Data Privacy & Cybersecurity alerts

Weekly digest. AI-summarized, no noise.

Free. Unsubscribe anytime.

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Optional. Personalizes your daily digest.

Free. Unsubscribe anytime.