ePO, ESM and DXL
CVE-2023-6070: Server-side request forgery in Trellix Enterprise Security Manager (ESM)
A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially altering configuration.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Trellix Enterprise Security Manager (ESM) 11.6 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially altering configuration. This is possible through the certificate validation functionality where the API accepts uploaded content and doesn't parse for invalid data
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.