The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before…
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) before 2.0.1.140.1, Data Loss Prevention Endpoint (DLPe) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Device Control (MDC) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Endpoint Security (ENS) 10.x before 10.1, Host Intrusion Prevention Service (IPS) 8.0 before 8.0.0.3624, and VirusScan Enterprise (VSE) 8.8 before P7 (8.8.0.1528) on Windows allows local administrators to bypass intended self-protection rules and disable the antivirus engine by modifying registry keys.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mcafee:active_response:*:*:*:*:*:*:*:* | up to 1.1.0.158 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:agent:*:*:*:*:*:*:*:* | up to 5.0.2.285 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:data_exchange_layer:*:*:*:*:*:*:*:* | up to 2.0.0.430.1 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:data_loss_prevention_endpoint:*:p5:*:*:*:*:*:* | up to 9.3.0 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:data_loss_prevention_endpoint:*:p1_hf2:*:*:*:*:*:* | up to 9.4.0 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:endpoint_security:*:*:*:*:*:*:*:* | up to 10.0.1 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:host_intrusion_prevention:*:p6:*:*:*:*:*:* | up to 8.0.0 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:virusscan_enterprise:*:p6:*:*:*:*:*:* | up to 8.8.0 | Vulnerable | McAfee |
- cpe:2.3:a:mcafee:active_response:*:*:*:*:*:*:*:* Versions up to 1.1.0.158 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:agent:*:*:*:*:*:*:*:* Versions up to 5.0.2.285 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:data_exchange_layer:*:*:*:*:*:*:*:* Versions up to 2.0.0.430.1 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:data_loss_prevention_endpoint:*:p5:*:*:*:*:*:* Versions up to 9.3.0 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:data_loss_prevention_endpoint:*:p1_hf2:*:*:*:*:*:* Versions up to 9.4.0 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:endpoint_security:*:*:*:*:*:*:*:* Versions up to 10.0.1 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:host_intrusion_prevention:*:p6:*:*:*:*:*:* Versions up to 8.0.0 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:virusscan_enterprise:*:p6:*:*:*:*:*:* Versions up to 8.8.0 Vulnerable ·McAfee
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-3984
- 2026-10-03 Alias added: GHSA-55vh-mg3p-5pp2
References
More McAfee Active Response vulnerabilities
- TI-2019-02686 MWG scanners updated to address CVE-2019-9517 CVSS 3.1HIGH 7.5
- TI-2019-02685 MWG scanners updated to address CVE-2019-9511 CVSS 3.1HIGH 7.5
- TI-2020-05896 Privilege Escalation vulnerability MAR for Mac CVSS 3.1HIGH 7.8
- TI-2020-05895 Privilege Escalation vulnerability in MAR for Linux CVSS 3.1HIGH 7.8
- TI-2020-05894 Privilege Escalation vulnerability in MAR for Windows CVSS 3.1HIGH 7.8
- TI-2020-05929 McAfee MAR - Improperly implemented security check CVSS 3.1MEDIUM 6.7
Sources
- CVE-2016-3984 · CVE Program
- CVE-2016-3984 · NVD
- FIRST EPSS
- GHSA-55vh-mg3p-5pp2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences