Skip to content
Fencer Vulns
high 8.2

CVE-2021-23874 kev in the critical feed json

McAfee Total Protection (MTP) privilege escalation vulnerability

published 2021-02-10 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-10800

cvss
8.2
version 3.1, CNA
cisa kev
Exploited
added 2021-11-03
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • McAfee,LLC McAfee Total Protection (MTP) 16.0.30

Timeline

  1. Published
  2. Added to CISA KEV
  3. CISA patch deadline
  4. CISA SSVC: exploitation active

Known exploited

Added
5 y ago
Patch by
2021-11-17 (4 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
McAfee, McAfee Total Protection (MTP)
CISA name
McAfee Total Protection (MTP) Improper Privilege Management Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
21 mo ago

Exploit prediction

1.07% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • McAfee,LLC McAfee Total Protection (MTP)

Classification

Weakness
  • CWE-269 Improper Privilege Management
  • CWE-732 Incorrect Permission Assignment for Critical Resource

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.