CVE-2016-3984

Severity: medium (CVSS 5.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-04-08 · updated 2026-06-17
Weakness: CWE-284

Description

The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) before 2.0.1.140.1, Data Loss Prevention Endpoint (DLPe) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Device Control (MDC) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Endpoint Security (ENS) 10.x before 10.1, Host Intrusion Prevention Service (IPS) 8.0 before 8.0.0.3624, and VirusScan Enterprise (VSE) 8.8 before P7 (8.8.0.1528) on Windows allows local administrators to bypass intended self-protection rules and disable the antivirus engine by modifying registry keys.

Affected products

McAfee,LLC McAfee Active Response: through 1.1.0.158
McAfee,LLC McAfee Agent for Windows: through 5.0.2.285
McAfee, LLC Data Exchange Layer (DXL) Broker: through 2.0.0.430.1
McAfee,LLC McAfee Data Loss Prevention (DLP) Endpoint for Windows: through 9.3.0; through 9.4.0
McAfee LLC McAfee Endpoint Security (ENS): through 10.0.1
McAfee, LLC McAfee Host Intrusion Prevention System (Host IPS) for Windows: through 8.0.0
Intel VirusScan Enterprise Linux (VSEL): through 8.8.0

References

Get alerted when CVE-2016-3984 or the next vulnerability affects your stack