Trellix Network Security CM/NX Code Injection Vulnerability (CVE-2025-7958) Advisory

Vulnerability Overview Vulnerability Name: CVE-2025-7958 Vulnerability Description: A code injection vulnerability exists in Trellix Network Security CM and NX. A locally authenticated administrator user can exploit this vulnerability to execute arbitrary code. CVSS Score: 7.1 (High) Affected Scope Affected Products: Trellix Network Security CM and NX Affected Versions: 10.0.4 and earlier Remediation Fixed Version: 11.0.0 Release Date: May 13, 2025 Download Link: Product Downloads site Additional Information Publication Date: June 26, 2026 Last Modified Date: June 26, 2026, 11:32 AM Attachments File Count: 0 Disclaimer The information provided in this security advisory is provided "as is" without warranty of any kind, either expressed or implied, including but not limited to warranties of merchantability and fitness for a particular purpose. Resources Technical Support: Log in to the Thrive Portal and open a new case. Frequently Asked Questions How to confirm if the product is affected: Use the command to check the current version. CVSS Scoring Criteria: Based on the NIST CVSS scoring system, assessing the severity of the vulnerability. Vulnerability Score Metrics Base Score: 7.1 Attack Vector: Adjacent (A) Attack Complexity: Low (L) Privileges Required: None (N) User Interaction: None (N) Impact Metrics: - Confidentiality: High (H) - Integrity: High (H) - Availability: High (H) Threat Indicators Disclosure Maturity: Proof of Concept (POC) Summary This vulnerability allows a locally authenticated administrator to execute arbitrary code on Trellix Network Security CM and NX, affecting versions 10.0.4 and earlier. It is recommended to upgrade to version 11.0.0 to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Trellix Network Security CM/NX Code Injection Vulnerability (CVE-2025-7958) Advisory