CVE-2026-101034: Security Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentials
Published Oct 27, 2026
·Updated
An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmitted by GSS Deployment Server installation.
Affected Software
1 affected component
Symantec GSS Deployment Server=3.3 RU11
Event History
Oct 27, 2026
CVE Published
via MITRE·07:15 AM
Data Sourced
via MITRE·07:15 AM
DescriptionWeakness
Frequently Asked Questions
1
What credentials could be exposed if this issue is exploited?
The affected data includes domain and service-account passwords, task run-as credentials, and sysprep passwords that are stored in or transmitted by a GSS Deployment Server installation.
2
What must an attacker obtain to recover the stored credentials?
The attacker must obtain the hardcoded key. With that key, they could decrypt the affected passwords.