Is CVE-2025-58074 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-58074 being exploited in the wild.

How severe is CVE-2025-58074?

High severity, with a CVSS score of 8.8, published 4 May 2026.

Which products and versions are affected?

Gen Digital Secure VPN 6.5.0.59.

Is there a fix for CVE-2025-58074?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-58074 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2025-58074?

Check whether you run Gen Digital Secure VPN at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-58074: Gen Digital Norton Secure VPN privilege escalation in installer

CVE-2025-58074 · Severity: high · CVSS 8.8 · Published 2026-05-04

A security vulnerability in the Norton Secure VPN installer for Windows could allow a user with limited permissions to gain full administrative control over a computer. By manipulating temporary files during the installation process, an attacker can trick the software into deleting or replacing critical system files. This could lead to a complete takeover of the affected machine or a permanent disruption of services.

Vendors: Gen Digital.

Quick answers

Is CVE-2025-58074 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-58074 being exploited in the wild.
How severe is CVE-2025-58074?: High severity, with a CVSS score of 8.8, published 4 May 2026.
Which products and versions are affected?: Gen Digital Secure VPN 6.5.0.59.
Is there a fix for CVE-2025-58074?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-58074 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2025-58074?: Check whether you run Gen Digital Secure VPN at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in Norton Secure VPN (specifically version 6.5.0.59) due to insecure file operations during installation via the Microsoft Store. The installer, running with High Integrity privileges, attempts to decompress and verify a 7z file located in a user-writable directory (C:\ProgramData\NortonInstaller\Settings\). If the hash verification fails or the registry key is missing, the installer deletes the decompressed files. An attacker can exploit this by using a Windows Junction or Mount Point to redirect these deletion operations to arbitrary system files. By deleting protected files, an attacker can achieve arbitrary file deletion as SYSTEM, which can be leveraged to gain full administrative privileges.

Affected products

Gen Digital (NortonLifeLock) Norton Secure VPN 6.5.0.59

Timeline

2026-05-04: disclosed: Vulnerability disclosed by Cisco Talos and NVD
2026-05-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.