Read the docs
TI-2020-05934 Aliases CVE-2020-7331GHSA-w44x-f7wx-v7m6

Unquoted service executable path in McAfee Endpoint Security (ENS)

Priority LOW 34CWE-428Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-428.

Summary

Unquoted service executable path in McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows local users to cause a denial of service and malicious file execution via carefully crafted and named executable files.

Why it matters now

EPSS 0.00417 36th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeMcAfee Endpoint Security (ENS)prior to 10.7.0 November 2020 Update—No fix listedCNA
  • McAfee Endpoint Security (ENS) VendorMcAfee Affected prior to 10.7.0 November 2020 Update Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:endpoint_security:*:*:*:*:*:windows:*:*before 10.6.1VulnerableMcAfee
  • cpe:2.3:a:mcafee:endpoint_security:*:*:*:*:*:windows:*:* Versions before 10.6.1 Vulnerable ·McAfee

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7331
  2. 2026-10-03 Alias added: GHSA-w44x-f7wx-v7m6

References

Other 1

  • TI-2020-05935 Cross-Site Request Forgery (CSRF) in firewall ePO extension of McAfee Endpoint Security (ENS) CVSS 3.1HIGH 8.8
  • TI-2020-05923 Improper Access Control Vulnerability in ENS for Windows CVSS 3.1HIGH 8.8
  • TI-2020-05872 Privilege Escalation vulnerability through symbolic links in ENSM CVSS 3.1HIGH 8.8
  • TI-2020-05871 Privilege Escalation vulnerability through symbolic links in ENS for Windows CVSS 3.1HIGH 8.8
  • TI-2019-02647 McAfee Endpoint Security updates fix a privilege escalation vulnerability CVSS 3.0HIGH 8.6
  • TI-2020-05864 Privilege Escalation vulnerability through Symbolic links in ENS CVSS 3.1HIGH 8.4
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences