CVE-2025-14963

High

Published: 24 February 2026

Published

24 February 2026

Modified

26 February 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0003 7.9th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-14963 is a high-severity Improper Input Validation (CWE-20) vulnerability in Trellix Endpoint Security. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique LSASS Memory (T1003.001); ranked at the 7.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SA-18 (Tamper Resistance and Detection).

Threat & Defense at a Glance

What attackers do: exploitation maps to LSASS Memory (T1003.001) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly requires timely remediation of the specific vulnerability in the fekern.sys driver to eliminate the privilege escalation risk.

CM-11 User-installed Software good match

prevent

Prohibits local users from installing or loading unauthorized vulnerable drivers required for the BYOVD exploitation technique.

SA-18 Tamper Resistance and Detection good match

prevent

Implements tamper resistance and detection mechanisms that restrict unauthorized communication with the vulnerable driver to authorized processes only, matching the CVE's described mitigation.

MITRE ATT&CK Enterprise TechniquesAI

T1003.001 LSASS Memory Credential Access

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Vulnerability directly enables local privilege escalation via driver manipulation and provides access to LSASS memory for credential dumping.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerable Driver (BYOVD) was leveraged to gain access to…

the critical Windows process memory lsass.exe (Local Security Authority Subsystem Service). The fekern.sys is a driver file associated with the HX Agent (used in all existing HX Agent versions). The vulnerable driver installed in a product or a system running a fully functional HX Agent is, itself, not exploitable as the product’s tamper protection restricts the ability to communicate with the driver to only the Agent’s processes.

Deeper analysisAI

CVE-2025-14963 is a vulnerability in the HX Agent driver file fekern.sys, which affects all existing versions of the HX Agent. The issue, classified under CWE-20 with NVD-CWE-noinfo, enables a threat actor with local user access to gain elevated system privileges. This is achieved through a Bring Your Own Vulnerable Driver (BYOVD) technique that provides access to the memory of the critical Windows process lsass.exe (Local Security Authority Subsystem Service). The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

An attacker requires local user privileges on the target system to exploit this vulnerability. Successful exploitation allows elevation to system-level privileges by manipulating the vulnerable driver to read and potentially alter lsass.exe process memory. However, the vulnerable driver is not exploitable when installed in a product or system running a fully functional HX Agent, as the product's tamper protection limits driver communication to only the Agent's processes.

Mitigation guidance is available in the Trellix advisory at https://thrive.trellix.com/s/article/000015100.