DLL search order hijacking in Host IPS
Priority LOW 34CWE-426Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-426.
Summary
DLL Search Order Hijacking Vulnerability in the installer component of McAfee Host Intrusion Prevention System (Host IPS) for Windows prior to 8.0.0 Patch 15 Update allows attackers with local access to execute arbitrary code via execution from a compromised folder.
Why it matters now
EPSS 0.00423 36th percentileScored 2026-11-07
Fix Fixed McAfee Host Intrusion Prevention System (Host IPS) for Windows (McAfee, LLC): 8.0.0 Patch 15 update
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| McAfee | McAfee Host Intrusion Prevention System (Host IPS) for Windows | 8.0.x to before 8.0.0 Patch 15 update | 8.0.0 Patch 15 update | Patch available | CNA |
- McAfee Host Intrusion Prevention System (Host IPS) for Windows VendorMcAfee Affected 8.0.x to before 8.0.0 Patch 15 update Fixed in 8.0.0 Patch 15 update Patch available CNA
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:-:*:*:*:windows:*:* | 8.0.0 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p1:*:*:*:windows:*:* | 8.0.0 p1 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p10:*:*:*:windows:*:* | 8.0.0 p10 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p11:*:*:*:windows:*:* | 8.0.0 p11 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p12:*:*:*:windows:*:* | 8.0.0 p12 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p13:*:*:*:windows:*:* | 8.0.0 p13 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p14:*:*:*:windows:*:* | 8.0.0 p14 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p15:*:*:*:windows:*:* | 8.0.0 p15 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p2:*:*:*:windows:*:* | 8.0.0 p2 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p3:*:*:*:windows:*:* | 8.0.0 p3 | Vulnerable | McAfee |
- cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:-:*:*:*:windows:*:* Versions 8.0.0 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p1:*:*:*:windows:*:* Versions 8.0.0 p1 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p10:*:*:*:windows:*:* Versions 8.0.0 p10 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p11:*:*:*:windows:*:* Versions 8.0.0 p11 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p12:*:*:*:windows:*:* Versions 8.0.0 p12 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p13:*:*:*:windows:*:* Versions 8.0.0 p13 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p14:*:*:*:windows:*:* Versions 8.0.0 p14 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p15:*:*:*:windows:*:* Versions 8.0.0 p15 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p2:*:*:*:windows:*:* Versions 8.0.0 p2 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p3:*:*:*:windows:*:* Versions 8.0.0 p3 Vulnerable ·McAfee
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p4:*:*:*:windows:*:* | 8.0.0 p4 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p5:*:*:*:windows:*:* | 8.0.0 p5 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p6:*:*:*:windows:*:* | 8.0.0 p6 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p7:*:*:*:windows:*:* | 8.0.0 p7 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p8:*:*:*:windows:*:* | 8.0.0 p8 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p9:*:*:*:windows:*:* | 8.0.0 p9 | Vulnerable | McAfee |
- cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p4:*:*:*:windows:*:* Versions 8.0.0 p4 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p5:*:*:*:windows:*:* Versions 8.0.0 p5 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p6:*:*:*:windows:*:* Versions 8.0.0 p6 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p7:*:*:*:windows:*:* Versions 8.0.0 p7 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p8:*:*:*:windows:*:* Versions 8.0.0 p8 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:host_intrusion_prevention:8.0.0:p9:*:*:*:windows:*:* Versions 8.0.0 p9 Vulnerable ·McAfee
Remediation
- Fix · CNA McAfee Host Intrusion Prevention System (Host IPS) for Windows (McAfee, LLC) Fixed in 8.0.0 Patch 15 update
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7279
- 2026-10-03 Alias added: GHSA-p29m-rh76-2857
References
More McAfee Host Intrusion Prevention vulnerabilities
- TI-2016-03385 The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before… CVSS 3.0MEDIUM 5.1
- TI-2017-03022 SB10193 - consumer and corporate products - Maliciously misconfigured registry vulnerability CVSS 3.0MEDIUM 5.0
Sources
- CVE-2020-7279 · CVE Program
- CVE-2020-7279 · NVD
- FIRST EPSS
- GHSA-p29m-rh76-2857 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences