CVE-2021-23879

6.7 mediumEPSS 0.3%

Medium (6.7) in mcafee endpoint product removal tool. EPSS 0.3% chance of exploitation in the next 30 days.

Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with higher-level privileges, via execution from a compromised folder. The tool did not enforce and protect the execution path. Local admin privileges are required to place the files in the required location.

Severity

CVSS 3.1

6.7 medium

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
CWE: CWE-428
Published: 2021-03-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mcafee:endpoint_product_removal_tool

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10351
https://kc.mcafee.com/corporate/index?page=content&id=SB10351

Check your stack JSON