Description
An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.
Published: 2026-10-14
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Database Decryption
Action: Assess Impact
AI Analysis

Impact

An insecure hardcoded cryptographic key is embedded in Trellix Agent 5.8.4’s mfecryptc.dll, allowing regular local users to decrypt the agent’s locally stored databases and expose protected data without elevated privileges. The vulnerability is classified as CWE‑321, indicating the use of a static key that can be exploited by anyone who can read the agent files.

Affected Systems

This vulnerability affects the Trellix Agent product, version 5.8.4. Any installation of this agent that includes the mfecryptc.dll component is susceptible; older or newer versions are not listed as affected.

Risk and Exploitability

The CVSS score is 6.9, indicating medium severity. The EPSS score is less than 1%, implying a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack vector is local: a non‑privileged user on the host can read the agent’s database and use the hardcoded key to decrypt it.

Generated by OpenCVE AI on October 16, 2026 at 00:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Review Trellix's support portal for an updated Agent release that removes the hardcoded key and apply the patch when available.
  • Configure file system permissions to limit local users’ access to the Trellix Agent database directory and enforce least‑privilege principles.
  • As a temporary measure, consider removing or disabling the mfecryptc.dll component if an update is not immediately available, and verify that the Agent continues to operate correctly.

Generated by OpenCVE AI on October 16, 2026 at 00:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Trellix
Trellix agent
Vendors & Products Trellix
Trellix agent

Fri, 16 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Title Hardcoded Cryptographic Key Enables Local Database Decryption in Trellix Agent

Thu, 15 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Title Hardcoded Cryptographic Key Enables Local Database Decryption in Trellix Agent 5.8.4

Wed, 14 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Title Hardcoded Cryptographic Key Enables Local Database Decryption in Trellix Agent 5.8.4

Wed, 14 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
Description An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.
Weaknesses CWE-321
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Trellix Agent
cve-icon MITRE

Status: PUBLISHED

Assigner: trellix

Published:

Updated: 2026-10-14T15:57:50.108Z

Reserved: 2026-10-07T11:57:02.729Z

Link: CVE-2026-107171

cve-icon Vulnrichment

Updated: 2026-10-14T15:57:43.535Z

cve-icon NVD

Status : Deferred

Published: 2026-10-14T08:17:04.100

Modified: 2026-10-15T15:53:08.287

Link: CVE-2026-107171

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T13:09:25Z

Weaknesses
  • CWE-321

    Use of Hard-coded Cryptographic Key