During policy updates, the ccSvcHst.exe process on clients running Symantec Endpoint Protection (SEP)  can be observed using high CPU on a single core. This CPU usage may last for several minutes. On systems with a single core, this may lead to the system becoming unstable or unresponsive for an indefinite period of time.

No error message will be displayed. ccSvcHst.exe will show using a high amount of CPU usage in Windows task manager for several minutes.

This issue can be caused when the client processes an exceptions policy that has an excessive number of entries (over 1000).

Symantec does not recommend deploying exceptions policies with more than 1000 entries. Additional details on exception limitations can be found here: https://support.symantec.com/en_US/article.TECH237241.html