Vendor
Trellix vulnerabilities
50 advisories tracked, 0 exploited in the wild according to CISA, 3 published in 2026.
Data refreshed 13 Oct 2026
Patch now
Exploited in the last two years (CISA KEV), or a 10%+ chance of exploitation in the next 30 days (EPSS).
Nothing from Trellix meets this bar right now: no CVE in CISA's exploited list, and none with a high exploitation score.
Products covered
Select a product to see only its advisories.
- Endpoint Security and HXENS, the HX/EDR agent and console, and the Trellix Agent19 tracked
- ePO, ESM and DXLePolicy Orchestrator, the Enterprise Security Manager SIEM and the DXL broker15 tracked
- Network, Email and IPSThe NX, EX, AX and FX appliances, Central Management, Intelligent Sandbox and IPS Manager12 tracked
- Data Loss PreventionDLP Endpoint, DLP Network and the ePO extensions4 tracked
All tracked advisories
Newest first. Full analysis marks the CVEs we've written up in depth; the rest link to an automatic summary.
| Published | CVE | Product | Issue | Severity | EPSS | Exploited |
|---|---|---|---|---|---|---|
| CVE-2026-12588 | Endpoint Security and HX | An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX c… | MEDIUM 6 | 0.33% | – | |
| CVE-2025-7958 | Network, Email and IPS | Code Injection in Trellix Network Security NX, EX, FX, AX, and CMS | HIGH 7.1 | 0.31% | – | |
| CVE-2025-14963 | Endpoint Security and HX | A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user ac… | MEDIUM 6.2 | 0.11% | – | |
| CVE-2025-0664 | Endpoint Security and HX | A locally authenticated, privileged user can craft a malicious OpenSSL configuration file, potentially lead… | MEDIUM 6.7 | 0.18% | – | |
| CVE-2025-5967 | Endpoint Security and HX | Stored cross-site scripting in Endpoint Security HX | MEDIUM 5.3 | 0.19% | – | |
| CVE-2025-3773 | ePO, ESM and DXL | Sensitive information exposure in System Information Reporter | NONE 0 | 0.14% | – | |
| CVE-2025-3722 | ePO, ESM and DXL | Path traversal in System Information Reporter | NONE 0 | 0.18% | – | |
| CVE-2025-3771 | ePO, ESM and DXL | Path or symbolic link manipulation in System Information Reporter | HIGH 7.2 | 0.16% | – | |
| CVE-2025-0618 | Endpoint Security and HX | Malicious third party could invoke a persistent denial of service in FireEye EDR HX | MEDIUM 6.5 | 0.68% | – | |
| CVE-2025-0617 | Endpoint Security and HX | An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX c… | MEDIUM 5.9 | 0.40% | – | |
| CVE-2024-5955 | ePO, ESM and DXL | Cross-site scripting in ePO Onprem Sp1 Update4 | MEDIUM 5.4 | 0.37% | – | |
| CVE-2024-9679 | Data Loss Prevention | Hardcoded Cryptographic key in DLP Extension | MEDIUM 5.3 | 0.37% | – | |
| CVE-2024-9678 | Data Loss Prevention | SQL Injection in DLP Extension | MEDIUM 4.9 | 0.75% | – | |
| CVE-2024-11482 | ePO, ESM and DXL | A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables re… | CRITICAL 9.8 | 2.5% | – | |
| CVE-2024-11481 | ePO, ESM and DXL | A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. | HIGH 8.2 | 0.44% | – | |
| CVE-2024-5957 | Network, Email and IPS | This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of… | MEDIUM 6.3 | 0.38% | – | |
| CVE-2024-5956 | Network, Email and IPS | This vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data a… | MEDIUM 6.5 | 0.39% | – | |
| CVE-2024-7608 | Network, Email and IPS | An authenticated user can access the restricted files from NX, EX, FX, AX, IVX and CMS using path traversal. | MEDIUM 5.9 | 0.29% | – | |
| CVE-2024-5731 | Network, Email and IPS | A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an att… | MEDIUM 6.8 | 0.27% | – | |
| CVE-2024-5671 | Network, Email and IPS | Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to pe… | CRITICAL 9.8 | 0.93% | – | |
| CVE-2024-4176 | Endpoint Security and HX | Cross site scripting in Trellix EDR UI (XConsole) | MEDIUM 4.1 | 0.31% | – | |
| CVE-2024-4844 | ePO, ESM and DXL | Hardcoded credentials in ePolicy Orchestrator | HIGH 7.5 | 0.23% | – | |
| CVE-2024-4843 | ePO, ESM and DXL | ePO doesn't allow a regular privileged user to delete tasks or assignments. | MEDIUM 4.3 | 0.27% | – | |
| CVE-2023-6072 | Network, Email and IPS | Cross-site scripting in Trellix Central Management (CM) | MEDIUM 4.6 | 0.34% | – | |
| CVE-2024-0314 | Network, Email and IPS | XSS vulnerability in FireEye Central Management | MEDIUM 5.4 | 0.31% | – | |
| CVE-2024-0315 | Network, Email and IPS | Remote file inclusion vulnerability in FireEye Central Management | MEDIUM 6.6 | 0.33% | – | |
| CVE-2024-0316 | Endpoint Security and HX | Improper cleanup vulnerability in FireEye Endpoint Security | MEDIUM 6.8 | 0.32% | – | |
| CVE-2024-0317 | Network, Email and IPS | Cross-Site Scripting in FireEye EX | MEDIUM 5.4 | 0.31% | – | |
| CVE-2024-0320 | Network, Email and IPS | Cross-Site Scripting in FireEye Malware Analysis (AX) | MEDIUM 5.4 | 0.31% | – | |
| CVE-2024-0310 | Endpoint Security and HX | Content-security-policy in Trellix Endpoint Security (ENS) Web Control | MEDIUM 6.1 | 0.42% | – | |
| CVE-2024-0213 | Endpoint Security and HX | Buffer overflow in Trellix Agent (TA) | HIGH 8.2 | 0.17% | – | |
| CVE-2024-0206 | Endpoint Security and HX | Symbolic link manipulation in Anti-Malware Engine | HIGH 7.1 | 0.18% | – | |
| CVE-2023-6071 | ePO, ESM and DXL | Improper Neutralization of Special Elements used in a command in ESM | HIGH 8.4 | 0.85% | – | |
| CVE-2023-6070 | ePO, ESM and DXL | Server-side request forgery in Trellix Enterprise Security Manager (ESM) | MEDIUM 4.3 | 0.24% | – | |
| CVE-2023-5607 | Endpoint Security and HX | Improper limitation of a path name to a restricted directory (path traversal) in Trellix Application and Change Control (TACC) | HIGH 8.4 | 0.94% | – | |
| CVE-2023-5445 | ePO, ESM and DXL | Open redirect in ePolicy Orchestrator | MEDIUM 5.4 | 0.41% | – | |
| CVE-2023-5444 | ePO, ESM and DXL | CSRF in ePO leading to privilege escalation | HIGH 8 | 0.35% | – | |
| CVE-2023-3665 | Endpoint Security and HX | Code injection in Trellix Endpoint Security | MEDIUM 5.5 | 0.23% | – | |
| CVE-2023-4814 | Data Loss Prevention | Privilege escalation in Data Loss Prevention Endpoint for Windows | HIGH 7.1 | 0.15% | – | |
| CVE-2023-3946 | ePO, ESM and DXL | Reflected cross-site scripting (XSS) in Trellix EPO | MEDIUM 5.4 | 0.57% | – | |
| CVE-2023-3314 | ePO, ESM and DXL | A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). | HIGH 8.1 | 0.94% | – | |
| CVE-2023-3313 | ePO, ESM and DXL | OS common injection in Enterprise Security Manager | HIGH 7.8 | 0.47% | – | |
| CVE-2023-3438 | Endpoint Security and HX | Unquoted Windows search path in Trellix Move | MEDIUM 4.4 | 0.24% | – | |
| CVE-2023-0976 | Endpoint Security and HX | Command Injection in Trellix Agent | MEDIUM 6.3 | 0.62% | – | |
| CVE-2023-1388 | Endpoint Security and HX | Heap-based overflow in Trellix Agent | MEDIUM 6.3 | 0.57% | – | |
| CVE-2023-0977 | Endpoint Security and HX | Heap-based overflow in Trellix Agent | MEDIUM 6.7 | 0.64% | – | |
| CVE-2023-0975 | Endpoint Security and HX | A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users, dur… | HIGH 8.2 | 0.17% | – | |
| CVE-2023-0978 | Network, Email and IPS | Command injection in Trellix Intelligent Sandbox | MEDIUM 6.4 | 0.37% | – | |
| CVE-2023-0400 | Data Loss Prevention | The protection bypass in Data Loss Prevention (DLP) | MEDIUM 5.9 | 0.42% | – | |
| CVE-2023-0221 | Endpoint Security and HX | Product security bypass in Application and Change Control | MEDIUM 4.4 | 0.18% | – |
Sources: Trellix security advisories, CISA KEV and FIRST EPSS. Severity is the vendor's own rating.