What’s Vulnerable › Vulnerabilities

CVE-2018-6671: SB10240 - ePolicy Orchestrator (ePO) - Application Protection Bypass vulnerability

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-06-15 · updated 2026-06-17

Description

Application Protection Bypass vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows remote authenticated users to bypass localhost only access security protection for some ePO features via a specially crafted HTTP request.

Affected products

• McAfee,LLC McAfee ePolicy Orchestrator (ePO): from 5.3.0 through 5.3.3; from 5.9.0 through 5.9.1

References

• http://www.securityfocus.com/bid/104485
• http://www.securitytracker.com/id/1041155
• https://kc.mcafee.com/corporate/index?page=content&id=SB10240
• https://www.exploit-db.com/exploits/46518/
• http://www.securityfocus.com/bid/104485
• http://www.securitytracker.com/id/1041155
• https://kc.mcafee.com/corporate/index?page=content&id=SB10240
• https://www.exploit-db.com/exploits/46518/

Get alerted when CVE-2018-6671 or the next vulnerability affects your stack