ePO XML extended entity vulnerability
Priority LOW 18CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data.
Why it matters now
EPSS 0.00461 40th percentileScored 2026-11-07
Fix Fixed McAfee ePolicy Orchestrator (ePO) (McAfee,LLC): 5.10 CU 13
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| McAfee | McAfee ePolicy Orchestrator (ePO) | before 5.10 CU 13 | 5.10 CU 13 | Patch available | CNA |
- McAfee ePolicy Orchestrator (ePO) VendorMcAfee Affected before 5.10 CU 13 Fixed in 5.10 CU 13 Patch available CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:* | before 5.10.0 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:* | 5.10.0 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:* | 5.10.0 update_1 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:* | 5.10.0 update_10 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11:*:*:*:*:*:* | 5.10.0 update_11 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_12:*:*:*:*:*:* | 5.10.0 update_12 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:* | 5.10.0 update_2 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:* | 5.10.0 update_3 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:* | 5.10.0 update_4 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:* | 5.10.0 update_5 | Vulnerable | McAfee |
- cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:* Versions before 5.10.0 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:* Versions 5.10.0 update_1 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:* Versions 5.10.0 update_10 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11:*:*:*:*:*:* Versions 5.10.0 update_11 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_12:*:*:*:*:*:* Versions 5.10.0 update_12 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:* Versions 5.10.0 update_2 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:* Versions 5.10.0 update_3 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:* Versions 5.10.0 update_4 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:* Versions 5.10.0 update_5 Vulnerable ·McAfee
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:* | 5.10.0 update_6 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:* | 5.10.0 update_7 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:* | 5.10.0 update_8 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:* | 5.10.0 update_9 | Vulnerable | McAfee |
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:* Versions 5.10.0 update_6 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:* Versions 5.10.0 update_7 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:* Versions 5.10.0 update_8 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:* Versions 5.10.0 update_9 Vulnerable ·McAfee
Remediation
- Fix · CNA McAfee ePolicy Orchestrator (ePO) (McAfee,LLC) Fixed in 5.10 CU 13
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
McAfee,LLC McAfee ePolicy Orchestrator (ePO) 5.10 CU 13
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2022-00765 ePO database restoration vulnerabilityPriority LOW 29
- TI-2022-00763 ePO Reflected Cross-site scripting vulnerabilityPriority LOW 28
- TI-2022-00749 ePO blind SQL Injection vulnerabilityPriority LOW 26
Timeline
- 2026-10-02 Threatist record created from CVE-2022-0861
- 2026-10-03 Alias added: GHSA-pc2g-2g3x-j4c9
References
More McAfee Epolicy Orchestrator vulnerabilities
- TI-2020-10912 Infinite loop in Apache Tomcat CVSS 3.1HIGH 7.5
- TI-2006-04972 Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot… CVSS 2.0HIGH 10.0
- TI-2021-06204 Integer overflow in CipherUpdate CVSS 3.1HIGH 7.5
- TI-2021-12641 Incorrect Transfer-Encoding handling with HTTP/1.0 CVSS 3.1MEDIUM 5.3
- TI-2020-07593 Deserialization of untrusted data in Apache Tomcat CVSS 3.1HIGH 7.0
- TI-2021-02646 Read buffer overruns processing ASN.1 strings CVSS 3.1HIGH 7.4
Sources
- CVE-2022-0861 · CVE Program
- CVE-2022-0861 · NVD
- FIRST EPSS
- GHSA-pc2g-2g3x-j4c9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences