The vulnerability is a hard‑coded cryptographic key flaw that permits a remote attacker to decrypt stored credentials and evidence files. This weakness is identified as CWE‑321 and enables compromise of sensitive data accessed through the DLP on‑prem extensions.

The affected product is the Trellix DLP on‑prem extensions. Versions 11.13.1 and all earlier releases are vulnerable. Any deployment running those versions may expose credentials and evidence data to remote decryption.

The CVSS score of 6 indicates a medium severity. Because the EPSS score is not available, the current exploitation probability is unknown, and the vulnerability is not listed in CISA’s KEV catalog, the threat is moderate. The likely attack vector is a remote attacker exploiting the hard‑coded key, gaining the ability to decrypt protected data without additional system compromise.