$ cve CVE-2016-3984 JSON

CVE-2016-3984 EXPLOIT

5.1

MEDIUM · CVSS 3.0 · EPSS 1.1% (pctl 66)

Patch early

A public exploit exists.

Description

The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) before 2.0.1.140.1, Data Loss Prevention Endpoint (DLPe) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Device Control (MDC) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Endpoint Security (ENS) 10.x before 10.1, Host Intrusion Prevention Service (IPS) 8.0 before 8.0.0.3624, and VirusScan Enterprise (VSE) 8.8 before P7 (8.8.0.1528) on Windows allows local administrators to bypass intended self-protection rules and disable the antivirus engine by modifying registry keys.

Scoring

CVSS	5.1 (MEDIUM, v3.0)
Vector	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
EPSS	1.13% — more likely to be exploited than 66% of all CVEs
Weakness	CWE-284
On CISA KEV	no
Public exploit	yes
Published	2016-04-08
Last modified	2026-06-17

Affected (7)

Vendor	Product
mcafee	active response
mcafee	agent
mcafee	data exchange layer
mcafee	data loss prevention endpoint
mcafee	endpoint security
mcafee	host intrusion prevention
mcafee	virusscan enterprise

Public exploits

Source	Title	Date
exploit-db	McAfee VirusScan Enterprise 8.8 - Security Restrictions Bypass	2016-03-07

References

→ the Explorer · watch your stack · NVD