CVE-2021-23894: Unauthorized deserialization of untrusted data in McAfee DBSec

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-02 · updated 2026-06-17
Weakness: CWE-502

Description

Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote unauthenticated attacker to create a reverse shell with administrator privileges on the DBSec server via carefully constructed Java serialized object sent to the DBSec server.

Affected products

McAfee,LLC McAfee Database Security (DBSec): before 4.8.2 — fixed in 4.8.2

How to fix

Upgrade to a fixed version: McAfee,LLC McAfee Database Security (DBSec) 4.8.2. Check the vendor advisory for mitigations.

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10359
https://kc.mcafee.com/corporate/index?page=content&id=SB10359

Get alerted when CVE-2021-23894 or the next vulnerability affects your stack