Read the docs
TI-2020-05937 Aliases CVE-2020-7334GHSA-gfqr-2cch-p32h

Improper privilege assignment vulnerability in the installer component of MACC

Priority LOW 35CWE-266Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-266.

Summary

Improper privilege assignment vulnerability in the installer McAfee Application and Change Control (MACC) prior to 8.3.2 allows local administrators to change or update the configuration settings via a carefully constructed MSI configured to mimic the genuine installer. This version adds further controls for installation/uninstallation of software.

Why it matters now

EPSS 0.00285 21st percentileScored 2026-11-07
Fix Fixed McAfee Application and Change Control (MACC) (McAfee,LLC): 8.3.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeMcAfee Application and Change Control (MACC)8.x to before 8.3.28.3.2Patch availableCNA
  • McAfee Application and Change Control (MACC) VendorMcAfee Affected 8.x to before 8.3.2 Fixed in 8.3.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:application_and_change_control:*:*:*:*:*:*:*:*before 8.3.2VulnerableMcAfee
  • cpe:2.3:a:mcafee:application_and_change_control:*:*:*:*:*:*:*:* Versions before 8.3.2 Vulnerable ·McAfee

Remediation

  • Fix · CNA McAfee Application and Change Control (MACC) (McAfee,LLC) Fixed in 8.3.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7334
  2. 2026-10-03 Alias added: GHSA-gfqr-2cch-p32h

References

Other 1

  • TI-2021-11827 Improper privilege management in McAfee Application and Change Control CVSS 3.1HIGH 7.8
  • TI-2020-05867 MACC installer DLL side loading CVSS 3.1HIGH 7.8
  • TI-2017-02997 Improper authentication in McAfee Application Control and Change Control CVSS 3.0HIGH 7.8
  • TI-2020-05914 Cross Site Scripting vulnerability in ePO extension of MACC CVSS 3.1MEDIUM 4.8
  • TI-2023-00213 Improper privilege management in Trellix Application and Change Control CVSS 3.1MEDIUM 4.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences