CVE-2015-8765

Severity: high (CVSS 8.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-01-08 · updated 2026-06-17

Description

Intel McAfee ePolicy Orchestrator (ePO) 4.6.9 and earlier, 5.0.x, 5.1.x before 5.1.3 Hotfix 1106041, and 5.3.x before 5.3.1 Hotfix 1106041 allow remote attackers to execute arbitrary code via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Affected products

McAfee,LLC McAfee ePolicy Orchestrator (ePO): through 4.6.9; from 5.0.0 through 5.0.1; from 5.1.0 before 5.1.3; from 5.3.0 before 5.3.1 — fixed in 5.1.3, 5.3.1

How to fix

Upgrade to a fixed version: McAfee,LLC McAfee ePolicy Orchestrator (ePO) 5.1.3, 5.3.1. Check the vendor advisory for mitigations.

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10144
https://www.kb.cert.org/vuls/id/576313
https://kc.mcafee.com/corporate/index?page=content&id=SB10144
https://www.kb.cert.org/vuls/id/576313

Get alerted when CVE-2015-8765 or the next vulnerability affects your stack