CVE-2025-4660 is a critical flaw (CVSS 9.8) in the Windows agent of Forescout SecureConnector. A named pipe is open to the Everyone group and accepts remote connections, which lets a network attacker redirect the agent to a rogue server. Linux and macOS agents are not affected. Read Forescout's article and apply its fix.
What's affected
The NVD record names the Windows agent component of SecureConnector. It says the Linux and OSX versions are not affected. The record does not list version numbers or a fixed release, and it points to Forescout's support portal.
The support article may need a customer login. Forescout customers should use their account to find the affected and fixed versions for their deployment and the supported upgrade path.
How to check if you're exposed
Work from your Forescout console and your Windows fleet.
- In the Forescout console, list the SecureConnector version on each Windows endpoint.
- Compare those versions with the fixed versions in Forescout's support article.
- For a sample machine, review named pipe permissions with a tool your team trusts, such as Sysinternals PipeList and AccessChk, run by an administrator.
- Check whether SMB and other remote access to endpoints is open between network segments.
Linux and macOS endpoints are outside the scope of this record.
What to do now
- Open the Forescout support article linked in the record and note the affected and fixed versions.
- Deploy the fixed SecureConnector to Windows endpoints through your normal management channel, starting with servers and exposed hosts.
- Limit remote access between endpoints at the host firewall, so that only management systems can reach them over SMB and RPC.
- Review endpoint logs for unexpected connections from the agent to unfamiliar servers.
- Confirm with Forescout that your update contains the access fix for the pipe.
- Document which endpoint groups were updated and when.
Why it matters
The record lists CWE-276 (Incorrect Default Permissions). Named pipes are a Windows way for programs to talk to each other. If a pipe lets the Everyone group connect and also allows remote connections, any host that can reach the endpoint can talk to a privileged agent.
Security agents run with high privileges on the machines they protect. A flaw in one is attractive, because control of the agent is control of the endpoint. The vector shows no login and no user interaction. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Are Linux and macOS agents affected?
The record says the issue does not affect Linux or OSX SecureConnector.
Where do I find the fixed version?
In Forescout's support article, which the record links. A customer login may be needed.
Sources
Last reviewed: 18 October 2026.
