CVE-2018-6664 json
SB10233 - Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 - Application Protections Bypass vulnerability
published 2018-05-25 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-18411
- cvss
- 5.8
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
Application Protections Bypass vulnerability in Microsoft Windows in McAfee Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 allows authenticated users to bypass the product block action via a command-line utility.
Patch / fix
- McAfee Data Loss Prevention (DLP) Endpoint 10.0.500, 11.0.400
Exploit prediction
0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 5.8 | CVSS:3.0/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:H |
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- McAfee Data Loss Prevention (DLP) Endpoint
Classification
- Weakness
-
- CWE-347 Improper Verification of Cryptographic Signature
References
Sources
- CVE List CVE-2018-6664
- NVD CVE-2018-6664
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.