Vulnerability Spotlight - McAfee ePolicy Orchestrator Data Channel Blind SQL Injection Vulnerability
Summary: Cisco Talos disclosed TALOS-2016-0229 / CVE-2016-8027, an exploitable blind SQL injection in McAfee ePolicy Orchestrator 5.3.0 that is reachable without user authentication. A crafted HTTP POST to the unauthenticated dcRedirect servlet is forwarded to the DataChannel servlet, where the supplied AgentGUID is used to build a SQL query, allowing information disclosure from the database or impersonation of a McAfee agent.
Why it matters: The vulnerable software is the centralized console that pushes antivirus policy and enforces defenses across the enterprise, and the injection point sits on a path that requires no credentials - any HTTP client can reach it. An attacker who can impersonate an agent or read from that database is operating inside the system that is supposed to be enforcing your endpoint controls.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2016-8027
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026