Read the docs
TI-2021-06239 Aliases CVE-2021-23885GHSA-286x-xfxm-75r6

Privilege escalation vulnerability in McAfee Web Gateway (MWG) UI

Priority MEDIUM 41CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

Privilege escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.8 allows an authenticated user to gain elevated privileges through the User Interface and execute commands on the appliance via incorrect improper neutralization of user input in the troubleshooting page.

Why it matters now

EPSS 0.01087 65th percentileScored 2026-11-07
Fix Fixed McAfee Web Gateway (MWG) (McAfee,LLC): 9.2.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeMcAfee Web Gateway (MWG)before 9.2.89.2.8Patch availableCNA
  • McAfee Web Gateway (MWG) VendorMcAfee Affected before 9.2.8 Fixed in 9.2.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*before 8.2.17; 9.2 to before 9.2.8; 10.0 to before 10.0.4VulnerableMcAfee
  • cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:* Versions before 8.2.17; 9.2 to before 9.2.8; 10.0 to before 10.0.4 Vulnerable ·McAfee

Remediation

  • Fix · CNA McAfee Web Gateway (MWG) (McAfee,LLC) Fixed in 9.2.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-23885
  2. 2026-10-03 Alias added: GHSA-286x-xfxm-75r6

References

Other 1

  • TI-2021-02242 Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer… KEVCVSS 3.1HIGH 7.8
  • TI-2019-06950 Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a… CVSS 3.1HIGH 7.5
  • TI-2019-06949 Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a… CVSS 3.1HIGH 7.5
  • TI-2019-06948 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a… CVSS 3.1HIGH 7.5
  • TI-2021-02413 NULL pointer deref in signature_algorithms processing CVSS 3.1MEDIUM 5.9
  • TI-2019-06946 Some HTTP/2 implementations are vulnerable to window size manipulation and stream… CVSS 3.1HIGH 7.5
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences