CVE-2024-0206 is a high severity (CVSS 7.1) symbolic link flaw in Trellix Anti-Malware Engine on Windows. An authenticated local user could trigger deletion of files they cannot normally touch. Engines older than the January 2024 release are affected, so update the engine.
What's affected
The record says Trellix Anti-Malware Engine prior to the January 2024 release is affected, and its product data lists the engine on Microsoft Windows. The record's configuration entry names engine build 6600, which is the version string NVD uses to mark the affected line. The fixed release is described only as the January 2024 release.
We could not retrieve the Trellix bulletin (SB10415) while preparing this page, because the server refused our connection. That means we cannot quote an exact fixed engine build. Read the bulletin for the build number before you sign off on remediation.
How to check if you're exposed
The anti-malware engine is updated through content and engine packages, not as a standalone application, so the version lives in your Trellix console and on the endpoint. In ePO or your management console, report the engine version across managed Windows systems and look for any that predate the January 2024 release. On a single endpoint, the Trellix product UI shows the engine version in its About or status page.
The attack needs a local, authenticated user, so the machines that matter most are shared systems: terminal servers, VDI pools, developer workstations and anything where non-administrators log in. Prioritise those before single-user laptops.
If a system has not checked in recently, treat its engine as unknown rather than fine. Stale agents are the usual reason an old engine stays in place after a release.
What to do now
- Pull a report of engine versions across Windows endpoints from your Trellix management console.
- Open Trellix bulletin SB10415 and note the exact fixed engine release.
- Push the January 2024 engine release or later to all affected endpoints, starting with shared and multi-user machines.
- Confirm the update on a sample of endpoints by checking the reported engine version after the next check in.
- Limit local logon rights on systems that cannot be updated yet.
Why it matters
The record describes a symbolic link problem. A local user adds an entry in the registry under the Trellix ENS registry folder that points to files the user would not normally be allowed to affect. After a scan, the engine follows the link and removes the files. Because the engine runs with high privileges, the user's low rights do not stop the deletion.
This is the weakness class CWE-59, improper link resolution before file access. The pattern is common in security software that runs scans as a privileged service: the service acts on a path without checking that the path still means what it meant when the user chose it. Deleting protected files can be turned into a privilege gain, which is why the record calls it escalation of privileges and scores integrity and availability impact as high.
The CVSS vector is local, low complexity and needs low privileges and no user interaction. The record's KEV flag is false and we found no statement of exploitation, so this is a patch-in-cycle item rather than an emergency, with priority on shared machines.
Quick check
Does this affect Linux or macOS endpoints?
The record's product data lists the engine on Windows. The advisory should be checked for any other platform notes.
Can a remote attacker use this?
The record scores it as a local issue that needs an authenticated user, so it is not remotely exploitable on its own.
Sources
- Trellix security bulletin SB10415 (could not be fetched, listed in the record)
- Gold entry for CVE-2024-0206
Last reviewed: 19 October 2026.
