McAfee ePolicy Orchestrator Java Object Deserialization RCE

Critical Nessus Plugin ID 88624


A security management application installed on the remote Windows host is affected by a remote code execution vulnerability.


The McAfee ePolicy Orchestrator (ePO) installed on the remote Windows host is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections (ACC) library. An unauthenticated, remote attacker can exploit this to execute arbitrary code on the target host.


Upgrade to McAfee ePO version 5.1.3 / 5.3.1 and then apply hotfix A patch for ePO version 5.1.4 is scheduled to be released in Q2 of 2016.

See Also

Plugin Details

Severity: Critical

ID: 88624

File Name: mcafee_epo_sb10144.nasl

Version: $Revision: 1.6 $

Type: local

Agent: windows

Family: Windows

Published: 2016/02/08

Modified: 2017/02/13

Dependencies: 67119

Risk Information

Risk Factor: Critical


Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND

Vulnerability Information

CPE: cpe:/a:mcafee:epolicy_orchestrator

Required KB Items: SMB/Registry/Enumerated, installed_sw/McAfee ePO

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2015/12/30

Vulnerability Publication Date: 2015/01/28

Reference Information

CVE: CVE-2015-8765

BID: 85696

OSVDB: 129952, 130424, 132458

CERT: 576313