CVE-2022-1257: Improper Verification of Cryptographic Signature by McAfee Agent

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-14 · updated 2026-06-17
Weakness: CWE-922

Description

Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive information through storage in ma.db. The sensitive information has been moved to encrypted database files.

Affected products

McAfee,LLC McAfee Agent for Windows: before 5.7.6 — fixed in 5.7.6

How to fix

Upgrade to a fixed version: McAfee,LLC McAfee Agent for Windows 5.7.6. Check the vendor advisory for mitigations.

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10382
https://kc.mcafee.com/corporate/index?page=content&id=SB10382

Get alerted when CVE-2022-1257 or the next vulnerability affects your stack