{"id":"CVE-2021-23874","aliases":["EUVD-2021-10800","GHSA-jx9f-q7vh-wf4p"],"status":"published","title":"McAfee Total Protection (MTP) privilege escalation vulnerability","description":"Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01071,"percentile":0.65289,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-269","CWE-284","CWE-732"],"published":"2021-02-10T10:25:24Z","modified":"2026-06-17T03:38:57Z","kev":{"date_added":"2021-11-03","due_date":"2021-11-17","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"products":[{"vendor":"mcafee","product":"mcafee total protection (mtp)"},{"vendor":"mcafee","product":"total_protection"},{"vendor":"mcafee,llc","product":"mcafee total protection (mtp)"}],"references":[{"url":"http://service.mcafee.com/FAQDocument.aspx?\u0026id=TS103114","tags":["x_refsource_CONFIRM","x_transferred","Broken Link"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-23874","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23874"},{"url":"https://github.com/advisories/GHSA-jx9f-q7vh-wf4p"}],"sources":{"cve":[{"id":"CVE-2021-23874","title":"McAfee Total Protection (MTP) privilege escalation vulnerability","description":"Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense.","status":"published","published":"2021-02-10T10:25:24Z","modified":"2025-10-21T23:35:28.347Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-10800","description":"Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense.","status":"published","published":"2021-02-10T10:25:24Z","modified":"2025-10-21T23:35:28Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T20:31:25.308373Z"}],"ghsa":[{"id":"GHSA-jx9f-q7vh-wf4p","title":"Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30...","description":"Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense.","status":"published","published":"2022-05-24T17:41:46Z","modified":"2025-10-22T00:33:07Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269","CWE-732"],"updated_at":"2026-11-02T15:04:07.67458Z"}],"kev":[{"id":"CVE-2021-23874","title":"McAfee Total Protection (MTP) Improper Privilege Management Vulnerability","description":"McAfee Total Protection (MTP) contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense.","cwes":["CWE-284"],"kev":{"date_added":"2021-11-03","due_date":"2021-11-17","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2021-23874","description":"Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense.","status":"published","published":"2021-02-10T11:15:12.943Z","modified":"2026-06-17T03:38:57.85Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-269","CWE-732"],"updated_at":"2026-11-02T14:06:50.031227Z"}]}}