Read the docs
TI-2019-02647 Aliases CVE-2019-3582GHSA-9vm4-rfx8-h4hf

McAfee Endpoint Security updates fix a privilege escalation vulnerability

Priority LOW 37Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

Privilege Escalation vulnerability in Microsoft Windows client in McAfee Endpoint Security (ENS) 10.6.1 and earlier allows local users to gain elevated privileges via a specific set of circumstances.

Why it matters now

EPSS 0.00382 32nd percentileScored 2026-11-07
Fix Fixed McAfee Endpoint Security (ENS) (McAfee, LLC): 10.5.3 Hotfix 1240838, 10.5.4 Hotfix 1240838, 10.5.5 Nov 2018 update +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeMcAfee Endpoint Security (ENS)10.5.3 to before 10.5.3 Hotfix 1240838; 10.5.4 to before 10.5.4 Hotfix 1240838; 10.5.5 to before 10.5.5 Nov 2018 update; 10.6.1 to before 10.6.1 Nov 2018 update10.5.3 Hotfix 1240838, 10.5.4 Hotfix 1240838, 10.5.5 Nov 2018 update, 10.6.1 Nov 2018 updatePatch availableCNA
  • McAfee Endpoint Security (ENS) VendorMcAfee Affected 10.5.3 to before 10.5.3 Hotfix 1240838; 10.5.4 to before 10.5.4 Hotfix 1240838; 10.5.5 to before 10.5.5 Nov 2018 update; 10.6.1 to before 10.6.1 Nov 2018 update Fixed in 10.5.3 Hotfix 1240838, 10.5.4 Hotfix 1240838, 10.5.5 Nov 2018 update, 10.6.1 Nov 2018 update Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:endpoint_security:*:*:*:*:*:*:*:*up to 10.6.1VulnerableMcAfee
  • cpe:2.3:a:mcafee:endpoint_security:*:*:*:*:*:*:*:* Versions up to 10.6.1 Vulnerable ·McAfee

Remediation

  • Fix · CNA McAfee Endpoint Security (ENS) (McAfee, LLC) Fixed in 10.5.3 Hotfix 1240838, 10.5.4 Hotfix 1240838, 10.5.5 Nov 2018 update, 10.6.1 Nov 2018 update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3582
  2. 2026-10-03 Alias added: GHSA-9vm4-rfx8-h4hf

References

Other 1

  • TI-2020-05935 Cross-Site Request Forgery (CSRF) in firewall ePO extension of McAfee Endpoint Security (ENS) CVSS 3.1HIGH 8.8
  • TI-2020-05923 Improper Access Control Vulnerability in ENS for Windows CVSS 3.1HIGH 8.8
  • TI-2020-05872 Privilege Escalation vulnerability through symbolic links in ENSM CVSS 3.1HIGH 8.8
  • TI-2020-05871 Privilege Escalation vulnerability through symbolic links in ENS for Windows CVSS 3.1HIGH 8.8
  • TI-2020-05864 Privilege Escalation vulnerability through Symbolic links in ENS CVSS 3.1HIGH 8.4
  • TI-2020-05857 ENS symbolic link log file manipulation vulnerability CVSS 3.1HIGH 8.2
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences