Read the docs
TI-2020-05940 Aliases CVE-2020-7337GHSA-38q2-qj9f-p542

Incorrect permission assignment in McAfee VirusScan Enterprise

Priority LOW 30CWE-732Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Incorrect Permission Assignment for Critical Resource vulnerability in McAfee VirusScan Enterprise (VSE) prior to 8.8 Patch 16 allows local administrators to bypass local security protection through VSE not correctly integrating with Windows Defender Application Control via careful manipulation of the Code Integrity checks.

Why it matters now

EPSS 0.00412 35th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeVirusScan Enterprise (VSE)8.8.x – patch 15—No fix listedCNA
  • VirusScan Enterprise (VSE) VendorMcAfee Affected 8.8.x – patch 15 Fixed in — No fix listed CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:virusscan_enterprise:*:*:*:*:*:*:*:*before 8.8VulnerableMcAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:-:*:*:*:*:*:*8.8VulnerableMcAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch1:*:*:*:*:*:*8.8 patch1VulnerableMcAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch10:*:*:*:*:*:*8.8 patch10VulnerableMcAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch11:*:*:*:*:*:*8.8 patch11VulnerableMcAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch12:*:*:*:*:*:*8.8 patch12VulnerableMcAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch13:*:*:*:*:*:*8.8 patch13VulnerableMcAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch14:*:*:*:*:*:*8.8 patch14VulnerableMcAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch15:*:*:*:*:*:*8.8 patch15VulnerableMcAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch2:*:*:*:*:*:*8.8 patch2VulnerableMcAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:*:*:*:*:*:*:*:* Versions before 8.8 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:8.8:-:*:*:*:*:*:* Versions 8.8 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch1:*:*:*:*:*:* Versions 8.8 patch1 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch10:*:*:*:*:*:* Versions 8.8 patch10 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch11:*:*:*:*:*:* Versions 8.8 patch11 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch12:*:*:*:*:*:* Versions 8.8 patch12 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch13:*:*:*:*:*:* Versions 8.8 patch13 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch14:*:*:*:*:*:* Versions 8.8 patch14 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch15:*:*:*:*:*:* Versions 8.8 patch15 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch2:*:*:*:*:*:* Versions 8.8 patch2 Vulnerable ·McAfee
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch3:*:*:*:*:*:*8.8 patch3VulnerableMcAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch4:*:*:*:*:*:*8.8 patch4VulnerableMcAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch5:*:*:*:*:*:*8.8 patch5VulnerableMcAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch6:*:*:*:*:*:*8.8 patch6VulnerableMcAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch7:*:*:*:*:*:*8.8 patch7VulnerableMcAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch8:*:*:*:*:*:*8.8 patch8VulnerableMcAfee
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch9:*:*:*:*:*:*8.8 patch9VulnerableMcAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch3:*:*:*:*:*:* Versions 8.8 patch3 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch4:*:*:*:*:*:* Versions 8.8 patch4 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch5:*:*:*:*:*:* Versions 8.8 patch5 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch6:*:*:*:*:*:* Versions 8.8 patch6 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch7:*:*:*:*:*:* Versions 8.8 patch7 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch8:*:*:*:*:*:* Versions 8.8 patch8 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch9:*:*:*:*:*:* Versions 8.8 patch9 Vulnerable ·McAfee

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7337
  2. 2026-10-03 Alias added: GHSA-38q2-qj9f-p542

References

Other 1

  • TI-2016-06740 Improper authentication in Intel VirusScan Enterprise Linux CVSS 3.0HIGH 7.5
  • TI-2016-06738 Code injection in Intel VirusScan Enterprise Linux CVSS 3.0HIGH 8.0
  • TI-2016-06742 HTTP response splitting in Intel VirusScan Enterprise Linux CVSS 3.0HIGH 8.1
  • TI-2016-06741 Improper authentication in Intel VirusScan Enterprise Linux CVSS 3.0HIGH 8.1
  • TI-2009-04865 Untrusted search path vulnerability in McAfee VirusScan Enterprise before 8.7i allows… CVSS 2.0HIGH 9.3
  • TI-2007-02073 Buffer overflow in the On-Access Scanner in McAfee VirusScan Enterprise before 8.0i Patch… CVSS 2.0HIGH 7.9
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences