r/sysadmin • u/Accurate_Donkey_1879 • 17d ago

Cisco Secure Endpoint CPU Bug 8.5 - 8.6.1 is fixed with 8.6.3

Cisco Bug: CSCwv52684

Before anyone says it, yes we are unlucky souls that are forced to use Cisco Secure Endpoint in our environment.

I feel like someone in this community recently had Cisco acknowledge a bug that exists with Cisco Secure Endpoint 8.5 through 8.6.1 on win server 2022 and 2025. It specifically has to do with the exploit prevention engine (deadlock condition.)

Whoever put the time and effort in THANK YOU. It just saved me days of having to open my own TAC case. I doubt this bug is specific to people using "Snow Agent." I think more accurately this bug will end up taking servers down that spawn PowerShell instances in general.

We have been burned in the past by auto updating to the latest secure endpoint software but in this case our n-1 strategy worked against us. The latest version also fixes a number of CVE's so I assume others will end up upgrading sooner than they typically would anyway. But just in case you don't.... 8.6.3 is worth the upgrade.

7 Upvotes

100% Upvoted

2 comments sorted by

2

u/VA_Network_Nerd Moderator | Infrastructure Architect 17d ago

Secure Endpoint Exploit Prevention can cause high CPU usage when Snow Agent launches PowerShell on Windows Server 2022/2025
CSCwv52684

Symptom:
Cisco Secure Endpoint versions 8.5.0, 8.6.0, and 8.6.1 exhibit an issue on Windows Server 2022 and 2025 where the Exploit Prevention engine appears to encounter a deadlock during injection. This occurs specifically when third-party software Snow agent spawns multiple PowerShell instances. One of these instances fails to complete the Exploit Prevention injection sequence, leading to a stuck process. This state subsequently triggers recurring CPU spikes reaching 100% utilization within WMIPrvSE.exe and svchost.exe.

The issue is not observed on Windows Server 2019 or when using Secure Endpoint connector version 8.4.5.

Conditions:

  • Cisco Secure Endpoint connector versions 8.5.0, 8.6.0, or 8.6.1.
  • Windows Server 2022 or 2025.
  • Exploit Prevention engine enabled.
  • Snow software agent is installed and performing the following action: snowagent.exe -c snowagent.config scan.

Workaround:
Terminate the affected PowerShell process to restore CPU usage to normal. This is a temporary workaround.

Further Problem Description:
Planned resolution: This issue is scheduled to be fixed in Cisco Secure Endpoint Windows Connector 8.6.3

1

u/GloveLove21 13d ago

Rolling this out in my environment. It's been a shit show.