CVE-2019-3597: Authentication bypass in McAfee Network Security Manager 9.x

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-03-26 · updated 2026-06-17

Description

Authentication Bypass vulnerability in McAfee Network Security Manager (NSM) 9.1 < 9.1.7.75.2 and 9.2 < 9.2.7.31 (9.2 Update 2) allows unauthenticated users to gain administrator rights via incorrect handling of expired GUI sessions.

Affected products

McAfee Network Security Management (NSM): from 9.1 before 9.1.7.75; from 9.2 before 9.2.7.31 — fixed in 9.1.7.75, 9.2.7.31

How to fix

Upgrade to a fixed version: McAfee Network Security Management (NSM) 9.1.7.75, 9.2.7.31. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/107609
https://kc.mcafee.com/corporate/index?page=content&id=SB10275
http://www.securityfocus.com/bid/107609
https://kc.mcafee.com/corporate/index?page=content&id=SB10275

Get alerted when CVE-2019-3597 or the next vulnerability affects your stack