# CVE-2026-19810: Symantec Endpoint Detection and Response Console cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-19810-symantec-endpoint-detection-and-response-sedr-console-prior-to-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-19810 · Severity: medium · CVSS 5.4 · Published 2026-10-13

Symantec Endpoint Detection and Response (SEDR) Console is a security management platform used to monitor and respond to endpoint threats across enterprise networks. An attacker with authenticated access could inject malicious scripts that execute in the browser session of administrative users, potentially allowing unauthorized access to sensitive functionality and data normally restricted to those users.

Vendors: [Symantec](https://junglewise.ai/threats/vendors/symantec).

## Quick answers

**Is CVE-2026-19810 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19810 being exploited in the wild.

**How severe is CVE-2026-19810?** Medium severity, with a CVSS score of 5.4, published 13 October 2026.

**Which products and versions are affected?** Symantec Endpoint Detection and Response Console prior to 4.13.

**Is there a fix for CVE-2026-19810?** Yes: fixed in 4.13. Until then: Restrict access to SEDR Console administrative and management systems to authorized privileged users only. Restrict remote access to trusted and authorized systems. Deploy network and host-based intrusion detection to monitor for signs of suspicious activity that may indicate exploitation attempts. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19810 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-19810?** Check whether you run Symantec Endpoint Detection and Response Console at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.13

Restrict access to SEDR Console administrative and management systems to authorized privileged users only. Restrict remote access to trusted and authorized systems. Deploy network and host-based intrusion detection to monitor for signs of suspicious activity that may indicate exploitation attempts.

## Technical details

A reflected or stored cross-site scripting (XSS) vulnerability in SEDR Console prior to version 4.13 allows authenticated attackers to inject arbitrary JavaScript code via the management web interface. Exploitation requires user interaction (a privileged user must visit a crafted link or the attacker must have ability to inject content into the application). Successful exploitation grants the attacker access to the victim's session context and restricted administrative functions.

## Affected products

- Symantec Endpoint Detection and Response Console prior to 4.13

## Timeline

- 2026-10-13: disclosed

## References

- [https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38870](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38870)