What’s Vulnerable › Vulnerabilities

CVE-2022-0861: ePO XML extended entity vulnerability

• Severity: low (CVSS 3.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-23 · updated 2026-06-17
• Weakness: CWE-611

Description

A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data.

Affected products

• McAfee,LLC McAfee ePolicy Orchestrator (ePO): before 5.10.0; 5.10.0, 5.10.0-update_1, 5.10.0-update_10, 5.10.0-update_11, 5.10.0-update_12, 5.10.0-update_2 (+7) — fixed in 5.10.0

How to fix

Upgrade to a fixed version: McAfee,LLC McAfee ePolicy Orchestrator (ePO) 5.10.0. Check the vendor advisory for mitigations.

References

• https://kc.mcafee.com/corporate/index?page=content&id=SB10379
• https://kc.mcafee.com/corporate/index?page=content&id=SB10379

Get alerted when CVE-2022-0861 or the next vulnerability affects your stack