Trellix vulnerabilities
Published CVEs affecting Trellix products: 4 record(s), with severity, exploitation and fixes.
Endpoint Security 1Trellix Network Security NX, EX, FX, AX, and CMS 1Endpoint HX Agent (xAgent) 1Trellix Agent 1Trellix HX Console 1
CVE-2026-107171
Medium · 6.9
CWE-321 Oct 14, 2026
An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll...
An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.
CVE-2026-12588
Medium · 6.0
CWE-409 Jul 14, 2026
An attacker with access to an HX 10.0.0 and previous versions, may send…
An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger decompression of a large file that consumes an excessive amount of system resources thus causing a Denial of Service.
CVE-2025-7958
High · 7.1
CWE-94 Jun 26, 2026
Code Injection in Trellix Trellix Network Security NX, EX, FX, AX, and CMS
A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code using the web interface and Alert artifact details.
CVE-2025-14963
High · 7.8
CWE-20 Feb 24, 2026
Improper Input Validation in Trellix Endpoint Security
A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver (BYOVD) was leveraged to gain access to the critical Windows process memory lsass.exe (Local Security Authority Subsystem Service). The fekern.sys is a driver file associated with the HX Agent (used in all existing HX Agent versions). The vulnerable driver installed in a product or a system running a fully functional HX Agent is, itself, not exploitable as the product’s tamper protection restricts the ability to communicate with the driver to only the Agent’s processes.