ePO, ESM and DXL
CVE-2023-3946: Reflected cross-site scripting (XSS) in Trellix EPO
A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Trellix EPO (Windows) | 5.10.0 SP1 UP1 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.