What’s Vulnerable › Vulnerabilities

CVE-2021-31838: Command injection through environment variable in MVISION EDR

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-29 · updated 2026-06-17
• Weakness: CWE-78

Description

A command injection vulnerability in MVISION EDR (MVEDR) prior to 3.4.0 allows an authenticated MVEDR administrator to trigger the EDR client to execute arbitrary commands through PowerShell using the EDR functionality 'execute reaction'.

Affected products

• McAfee,LLC MVISION EDR: before 3.4.0 — fixed in 3.4.0

How to fix

Upgrade to a fixed version: McAfee,LLC MVISION EDR 3.4.0. Check the vendor advisory for mitigations.

References

• https://kc.mcafee.com/corporate/index?page=content&id=SB10342
• https://kc.mcafee.com/corporate/index?page=content&id=SB10342

Get alerted when CVE-2021-31838 or the next vulnerability affects your stack