Read the docs
TI-2018-04914 Aliases CVE-2018-6671GHSA-wqhm-xfwm-vx5x

SB10240 - ePolicy Orchestrator (ePO) - Application Protection Bypass vulnerability

Priority LOW 34Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

Application Protection Bypass vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows remote authenticated users to bypass localhost only access security protection for some ePO features via a specially crafted HTTP request.

Why it matters now

EPSS 0.02583 85th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed ePolicy Orchestrator (ePO) (McAfee): 5.3.3 with hotfix EPO5xHF1229850, 5.9.1 with hotfix EPO5xHF1229850

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeePolicy Orchestrator (ePO)5.3.0 through 5.3.3 to before 5.3.3 with hotfix EPO5xHF1229850; 5.9.0 through 5.9.1 to before 5.9.1 with hotfix EPO5xHF12298505.3.3 with hotfix EPO5xHF1229850, 5.9.1 with hotfix EPO5xHF1229850Patch availableCNA
  • ePolicy Orchestrator (ePO) VendorMcAfee Affected 5.3.0 through 5.3.3 to before 5.3.3 with hotfix EPO5xHF1229850; 5.9.0 through 5.9.1 to before 5.9.1 with hotfix EPO5xHF1229850 Fixed in 5.3.3 with hotfix EPO5xHF1229850, 5.9.1 with hotfix EPO5xHF1229850 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*5.3.0 – 5.3.3; 5.9.0 – 5.9.1VulnerableMcAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:* Versions 5.3.0 – 5.3.3; 5.9.0 – 5.9.1 Vulnerable ·McAfee

Remediation

  • Fix · CNA ePolicy Orchestrator (ePO) (McAfee) Fixed in 5.3.3 with hotfix EPO5xHF1229850, 5.9.1 with hotfix EPO5xHF1229850

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    McAfee ePolicy Orchestrator (ePO) 5.3.3 with hotfix EPO5xHF1229850, 5.9.1 with hotfix EPO5xHF1229850

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2018-04915 SB10240 - ePolicy Orchestrator (ePO) - Information disclosure vulnerablityPriority LOW 31
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-6671
  2. 2026-10-03 Alias added: GHSA-wqhm-xfwm-vx5x

References

Exploit 1

Other 1

  • TI-2020-10912 Infinite loop in Apache Tomcat CVSS 3.1HIGH 7.5
  • TI-2006-04972 Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot… CVSS 2.0HIGH 10.0
  • TI-2021-06204 Integer overflow in CipherUpdate CVSS 3.1HIGH 7.5
  • TI-2021-12641 Incorrect Transfer-Encoding handling with HTTP/1.0 CVSS 3.1MEDIUM 5.3
  • TI-2020-07593 Deserialization of untrusted data in Apache Tomcat CVSS 3.1HIGH 7.0
  • TI-2021-02646 Read buffer overruns processing ASN.1 strings CVSS 3.1HIGH 7.4
See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences