CVE-2026-15380: ITMS 8.7.3 Privilege Escalation Vulnerability

CVE-2026-15380 Overview

CVE-2026-15380 is a local privilege escalation vulnerability affecting Broadcom IT Management Suite (ITMS) 8.7.3. A non-administrator interactive user can chain a Distributed Component Object Model (DCOM) call with the Windows Task Scheduler to obtain full NT AUTHORITY\SYSTEM code execution. The flaw is a logic issue tracked under [CWE-269: Improper Privilege Management], not a memory corruption bug. Exploitation requires no network access and no shellcode.

Critical Impact
Any interactive standard user on a host running the vulnerable ITMS 8.7.3 agent can escalate to SYSTEM, gaining full control of the endpoint and any credentials or data cached on it.

Affected Products

Broadcom IT Management Suite (ITMS) 8.7.3
Deployments where the ITMS agent runs privileged DCOM components on managed endpoints
Windows hosts with interactive user sessions where the vulnerable agent is installed

Discovery Timeline

2026-07-17 - CVE-2026-15380 published to the National Vulnerability Database
2026-07-21 - Last updated in the NVD database
Vendor advisory - Published as Broadcom Security Advisory #37995

Technical Details for CVE-2026-15380

Vulnerability Analysis

The issue is a privilege management flaw in how ITMS 8.7.3 exposes privileged functionality through DCOM. A low-privileged interactive user can invoke a DCOM interface offered by the ITMS agent. That interface, in turn, interacts with the Windows Task Scheduler in a way that permits the caller to influence work executed by a SYSTEM-context process. The chain converts a normal user session into arbitrary code execution as SYSTEM without exploiting any memory safety issue.

Because the exploitation path is composed entirely of legitimate operating system primitives (DCOM activation, task creation or manipulation), the primitives themselves are not malicious. The vulnerability lies in the trust boundary: the ITMS component accepts requests from a lower-privileged principal and performs work on their behalf at higher privilege.

Root Cause

The root cause is improper privilege management [CWE-269]. The ITMS agent exposes a DCOM surface accessible to interactive users but does not sufficiently validate that the caller is authorized to trigger the privileged Task Scheduler operations it performs. Insufficient impersonation, weak DACL configuration on the DCOM object, or missing caller identity checks allow the standard user to reach SYSTEM-level functionality.

Attack Vector

The attack vector is local and requires an authenticated interactive session on the target host. An attacker with a standard user account launches a client that activates the vulnerable DCOM interface. Through that interface, the attacker requests operations that cause the SYSTEM-privileged ITMS component to schedule or execute a task that runs attacker-controlled logic. The result is arbitrary code execution as SYSTEM. No exploit is publicly available and the CVE is not listed on the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.117%.

No verified proof-of-concept code has been published. Refer to Broadcom Security Advisory #37995 for vendor-supplied technical details.

Detection Methods for CVE-2026-15380

Indicators of Compromise

Scheduled tasks created or modified by the ITMS agent process where the task action points to unexpected binaries, scripts, or user-writable paths.
DCOM activations against ITMS agent CLSIDs originating from standard user sessions rather than management infrastructure.
New child processes of the ITMS agent service running as NT AUTHORITY\SYSTEM that spawn interactive shells such as cmd.exe or powershell.exe.

Detection Strategies

Monitor Windows Security event ID 4698 (task created) and 4702 (task updated) for tasks authored via the ITMS agent context but referencing user-controlled content.
Alert on Microsoft-Windows-DistributedCOM events showing standard users activating ITMS-related CLSIDs outside normal management workflows.
Baseline the parent-child process tree of the ITMS agent and flag deviations that result in SYSTEM-level interactive processes.

Monitoring Recommendations

Enable command-line auditing (Audit Process Creation with ProcessCommandLine) on all endpoints running the ITMS agent to capture task payloads.
Forward DCOM, Task Scheduler operational, and process creation logs to a centralized SIEM for correlation across hosts.
Track privilege transitions from interactive user tokens to SYSTEM tokens invoked through the ITMS service.

How to Mitigate CVE-2026-15380

Immediate Actions Required

Apply the fixed version identified in Broadcom Security Advisory #37995 on all hosts running ITMS 8.7.3.
Inventory endpoints with the ITMS agent installed and prioritize systems that host multiple interactive users, such as jump servers and shared workstations.
Restrict interactive logon on ITMS-managed servers to administrators until patching is complete.

Patch Information

Broadcom has published remediation guidance in Broadcom Security Advisory #37995. Administrators should follow the advisory to obtain the corrected ITMS agent build and roll it out through the existing ITMS management console or software distribution channel.

Workarounds

Tighten DCOM launch and access permissions on the affected ITMS CLSIDs so that only administrative principals can activate them.
Remove standard users from groups that permit interactive logon on servers hosting the ITMS agent where feasible.
Increase monitoring of Task Scheduler activity and DCOM activations on ITMS-managed endpoints until the patch is applied.

bash

# Configuration example: audit Task Scheduler and process creation on Windows endpoints
auditpol /set /subcategory:"Other Object Access Events" /success:enable /failure:enable
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable
wevtutil sl "Microsoft-Windows-TaskScheduler/Operational" /e:true