Read the docs
TI-2020-05867 Aliases CVE-2020-7260GHSA-qfr8-h4q4-v596

MACC installer DLL side loading

Priority LOW 34CWE-264Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-264 and CWE-426.

Summary

DLL Side Loading vulnerability in the installer for McAfee Application and Change Control (MACC) prior to 8.3 allows local users to execute arbitrary code via execution from a compromised folder.

Why it matters now

EPSS 0.0041 35th percentileScored 2026-11-07
Fix Fixed Mcafee Application and Change Control (MACC) (McAfee, LLC): 8.3, 8.2.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeMcafee Application and Change Control (MACC)8.x to before 8.3; 8.2.x to before 8.2.68.3, 8.2.6Patch availableCNA
  • Mcafee Application and Change Control (MACC) VendorMcAfee Affected 8.x to before 8.3; 8.2.x to before 8.2.6 Fixed in 8.3, 8.2.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:application_and_change_control:*:*:*:*:*:*:*:*before 8.3.0VulnerableMcAfee
  • cpe:2.3:a:mcafee:application_and_change_control:*:*:*:*:*:*:*:* Versions before 8.3.0 Vulnerable ·McAfee

Remediation

  • Fix · CNA Mcafee Application and Change Control (MACC) (McAfee, LLC) Fixed in 8.3, 8.2.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7260
  2. 2026-10-03 Alias added: GHSA-qfr8-h4q4-v596

References

Other 1

  • TI-2020-05937 Improper privilege assignment vulnerability in the installer component of MACC CVSS 3.1HIGH 8.2
  • TI-2021-11827 Improper privilege management in McAfee Application and Change Control CVSS 3.1HIGH 7.8
  • TI-2017-02997 Improper authentication in McAfee Application Control and Change Control CVSS 3.0HIGH 7.8
  • TI-2020-05914 Cross Site Scripting vulnerability in ePO extension of MACC CVSS 3.1MEDIUM 4.8
  • TI-2023-00213 Improper privilege management in Trellix Application and Change Control CVSS 3.1MEDIUM 4.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences