CVE-2021-23874

What it actually does

CVE-2021-23874 is a local privilege escalation vulnerability in McAfee Total Protection prior to version 16.0.30. A user who already has local, low-privileged access can abuse improper privilege management and bypass McAfee Total Protection self-defense protections to execute arbitrary processes with elevated privileges. Successful exploitation can provide high-impact confidentiality, integrity, and availability compromise on the affected endpoint because the attacker can run code with higher privileges than originally granted.

Why it matters to the business

An attacker or malware that has already gained a foothold on an endpoint can use this flaw to turn limited access into administrative control, disable or bypass endpoint protection, install persistence, steal data, or deploy additional payloads. Because this vulnerability is in CISA KEV with a remediation due date of 2021-11-17 and is marked as actively exploited in the wild, unpatched systems represent a legacy exposure that should be treated as a priority even though the EPSS score is low and stable. The operational risk is highest for organizations still running McAfee Total Protection versions earlier than 16.0.30 on workstations or servers where local users, malware, or remote-access intruders may obtain an initial foothold.

How an attack unfolds

An attacker first obtains local access to a system running a vulnerable version of McAfee Total Protection, typically through phishing, stolen credentials, malware execution, remote desktop access, or another initial-access technique. Once operating as a standard user, the attacker invokes the vulnerable privilege-management behavior in McAfee Total Protection to bypass its self-defense mechanism and cause an arbitrary process to run with elevated privileges. With elevated execution achieved, the attacker can disable security controls, tamper with antivirus services or configuration, dump credentials, install persistence, move laterally, or launch additional tooling. Public reporting indicates this vulnerability has been exploited in the wild, so defenders should assume it may be used as a post-compromise privilege-escalation step rather than as an internet-facing initial-access vector.

How to fix it

Upgrade McAfee Total Protection to version 16.0.30 or later on all affected endpoints. If central management is used, force a product update, verify signature/content updates are not being confused with product-version updates, and confirm the core application version is no longer earlier than 16.0.30. Where immediate upgrade is not possible, reduce exposure by restricting local interactive access, removing unnecessary local administrator rights, enforcing application control, monitoring attempts to stop or modify McAfee services, and isolating high-risk endpoints until remediated. Because this vulnerability is listed in CISA KEV and the remediation deadline has long passed, treat remaining vulnerable installations as overdue exceptions requiring formal risk acceptance or accelerated replacement.

How to confirm the fix worked

Confirm remediation by inventorying installed McAfee Total Protection versions and verifying every installation is version 16.0.30 or later. On Windows endpoints, validate through the product console, enterprise software inventory, installed-program records, and file-version metadata for McAfee components. Confirm McAfee self-defense or tamper-protection settings remain enabled after upgrade. Vulnerability scanners and endpoint management tools should be configured to flag McAfee Total Protection versions earlier than 16.0.30. For high-assurance validation, attempt only approved vendor-safe checks or configuration reviews; do not run public exploit code on production systems.

Typical attack path

1. Gain local low-privileged access to a Windows endpoint running McAfee Total Protection prior to 16.0.30.
2. Confirm the installed McAfee Total Protection version and identify that self-defense protections are vulnerable.
3. Trigger the vulnerable McAfee Total Protection privilege-management behavior to launch an attacker-controlled process with elevated privileges.
4. Use elevated privileges to bypass or tamper with endpoint protection and operating system controls.
5. Deploy follow-on payloads such as credential theft tools, persistence mechanisms, remote access tools, or lateral movement utilities.
6. Cover tracks by clearing logs, modifying security settings, or removing temporary exploit artifacts.

How to detect it

Look for evidence of post-compromise privilege escalation on endpoints that had McAfee Total Protection earlier than 16.0.30 installed. Useful log sources include Windows Security logs, Sysmon process creation events, service control events, McAfee product and agent logs, EDR telemetry, Windows Defender/third-party security health events, and software inventory history. Focus on low-privileged users spawning unexpected elevated processes, unusual child processes associated with McAfee executables or services, attempts to stop or reconfigure McAfee services, changes to tamper-protection or self-defense settings, new antivirus exclusions, suspicious scheduled tasks or services created shortly after McAfee-related activity, and credential-access tooling launched after elevation. Because no single public, universal exploit string is reliably associated with this issue, detection should emphasize behavior: McAfee component abuse followed by elevated command shells, script interpreters, service creation, security-tool tampering, or persistence. For systems that remained vulnerable after the KEV due date, review historical EDR and Windows logs around the compromise window and correlate with known attacker activity or malware campaigns present in the environment.

• McAfee Total Protection version < 16.0.30
• Event ID 4688 with elevated cmd.exe launched by or near McAfee process activity
• Event ID 4688 with elevated powershell.exe launched by or near McAfee process activity
• Event ID 4688 with elevated wscript.exe launched by or near McAfee process activity
• Event ID 4688 with elevated cscript.exe launched by or near McAfee process activity
• Event ID 4688 with elevated rundll32.exe launched by or near McAfee process activity
• Event ID 4688 with elevated regsvr32.exe launched by or near McAfee process activity
• Event ID 7045 indicating new service creation shortly after McAfee process activity
• sc stop McAfee
• sc stop mfemms
• sc stop mfevtp
• sc stop mcshield
• net stop McAfee
• net stop mfemms
• net stop mfevtp
• net stop mcshield
• taskkill /IM mcshield.exe
• taskkill /F /IM mcshield.exe
• HKLM\\SOFTWARE\\McAfee
• HKLM\\SOFTWARE\\WOW6432Node\\McAfee
• C:\\Program Files\\McAfee\\
• C:\\Program Files (x86)\\McAfee\\

What your security team should do

• Immediately identify all endpoints running McAfee Total Protection earlier than 16.0.30 and prioritize upgrade or removal.
• Treat any remaining vulnerable installation as a CISA KEV overdue remediation item and escalate through patch governance.
• Hunt for suspicious local privilege escalation behavior on systems that were vulnerable, especially unexpected elevated child processes launched near McAfee service activity.
• Review endpoint protection health for evidence of tampering, disabled services, changed self-defense settings, or unexplained exclusions.
• Correlate detections with initial-access indicators such as phishing payloads, suspicious user logons, remote access sessions, or malware execution before privilege escalation.
• Restrict local user privileges and enforce application control to reduce the ability of low-privileged users or malware to execute exploit tooling.
• If exploitation is suspected, isolate the endpoint, collect forensic artifacts, rotate credentials used on the host, and rebuild systems where endpoint protection integrity cannot be trusted.