CVE-2026-3991 describes an elevation of privilege vulnerability in Broadcom's Symantec Data Loss Prevention Windows Endpoint product. The vulnerability is categorized under CWE-829, indicating the inclusion of functionality from an untrusted control sphere. This flaw may allow an attacker with limited privileges to escalate their access rights within the application, potentially compromising protected resources. The affected versions are those prior to specific maintenance and hotfix releases listed in the description. The CVSS v3.1 base score is 7.8, reflecting high severity with attack vector local, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation information is provided in the input data.

Successful exploitation of this vulnerability could allow an attacker with local access and limited privileges to elevate their privileges, gaining unauthorized access to sensitive resources protected by the Symantec Data Loss Prevention Windows Endpoint software. The impact includes high confidentiality, integrity, and availability consequences as indicated by the CVSS score. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious activity related to privilege escalation attempts. Do not assume the vulnerability is mitigated without vendor confirmation.