CVE-2016-8020

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.08.0High EPSS percentile96th11% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2017-03-14Updated 2026-05-13Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your systems run “VirusScan Enterprise Linux (VSEL)” and confirm the installed version is 2.0.3 or earlier.
Confirm whether the vulnerable web interface/function is reachable in your environment (note: default configuration is not reachable).
Review McAfee’s remediation guidance for this issue (SB10181) and apply the vendor-recommended fix or configuration changes.
If you cannot patch immediately, restrict access so only trusted users/sources can reach the relevant web endpoint (especially block from the public internet).

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Improper control of generation of code vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to execute arbitrary code via a crafted HTTP request parameter.

In plain language

Written by AI from the record

If you run McAfee/Intel VirusScan Enterprise Linux (VSEL) 2.0.3 or earlier, a logged-in attacker could send a specially crafted web request to make the server run malicious commands—but this is not exposed in the default configuration, so only some setups are at risk.

Improper control of generation of code in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) can allow arbitrary code execution when an authenticated user sends a specially crafted HTTP request parameter; exploitation requires the vulnerable feature to be reachable and enabled.

If you're affected

Malware runs on the server
Full antivirus-service compromise
Potential data theft
Business disruption and downtime

What is it

This vulnerability is a “code execution” flaw: attackers who already have valid login access can trick VirusScan’s Linux web-facing component into running attacker-controlled commands. Think of it like having a back door that only opens to people who already have a key, and then that key can force the system to do something completely different from what the software is supposed to do. If someone gets through, it can lead to malware running on the server and serious operational disruption.

Who is affected

This matters if you run Intel Security VirusScan Enterprise Linux (VSEL) / McAfee VirusScan Enterprise on Linux, specifically version 2.0.3 or earlier. It requires an attacker to have valid login credentials, and there’s no evidence of needing user clicks or other user actions.

It’s only a risk if the vulnerable web request path is reachable in your environment—findings indicate it is not reachable in the default configuration.

How urgent is it

This is an AMBER risk because a public exploit exists and the likelihood is predicted to be rising, meaning active targeting is plausible. However, it is not reachable in the default configuration, which reduces exposure for many setups.

Treat it as a priority to verify reachability and apply the vendor guidance promptly, especially if your VSEL web interface is accessible beyond your internal trusted network.

What to do — in detail

Confirm product and version
- On the affected Linux host(s), identify whether you are running “VirusScan Enterprise Linux (VSEL)” and note whether the version is 2.0.3 or earlier.
- If you’re unsure, check installed package/application version details and correlate with your antivirus management deployment.
Confirm reachability (key gate)
- The findings state “reachable in default config: false.” Verify whether your deployment has the relevant web-facing component enabled and accessible.
- From a network perspective, confirm whether the endpoint that accepts the crafted HTTP request is reachable from anything more than your trusted internal administration network.
Apply vendor remediation
- Follow McAfee’s remediation guidance: SB10181 (https://kc.mcafee.com/corporate/index?page=content&id=SB10181).
- Implement the vendor’s recommended fix/upgrade and any configuration changes described in that bulletin.
If patching is delayed: reduce exposure immediately
- Restrict network access to only trusted admin systems.
- Block access from the public internet and any untrusted networks (firewall, security group, reverse proxy rules).
- Ensure only necessary accounts can authenticate to the service.
Verification after changes
- Re-check that the updated version/config matches the vendor’s recommended state.
- Confirm the vulnerable endpoint is no longer exposed per your reachability checks.
What to monitor
- Look for suspicious requests targeting unusual HTTP parameters on the VSEL web interface.
- Correlate with authentication logs (failed and successful logins) around the same time window.

Note on KEV: this issue is not listed in CISA KEV per the provided findings, so prioritize based on your actual exposure (version + reachability).

Technical context

Severity and nature: This is a high-impact “code execution” issue (CWE-94) affecting Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 and earlier / VirusScan Enterprise Linux (VSEL).

Mechanism: An authenticated attacker can send a crafted HTTP request so the server generates/executes unintended code/commands.

Attack vector and prerequisites: Network-based delivery (over HTTP) with authentication required; no user interaction is required.

Exposure reality check: “Reachable in default config: false” indicates that many typical installations may not expose the vulnerable path unless it’s enabled/configured to be reachable.

Exploitation status: A public exploit is available (1 known). KEV is not listed in CISA KEV per the findings.

Likelihood signal: EPSS is predicted and trending upward; per the rules, public blocks should not rely on the prediction for exploitation certainty.

Patching guidance: Use McAfee SB10181 for the exact remediation steps and any upgrade/configuration instructions.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

11% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Lifecycle

A public exploit existed 67 days before the patch.

2026-09-23EPSS band change0 → moderateepss band change
2026-09-21EPSS band changemoderate → 0epss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-29EPSS band changemoderate → low

Affected products

mcafeecommercial · USaka mcaee, mcafee security
- virusscan enterpriseSecurity Products
McAfee Inc.commercial · USaka mcafee
- McAfee VirusScan EnterpriseSecurity Products
Intelcommercial · USaka intel corp.
- VirusScan Enterprise Linux (VSEL)Hardware Firmware

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Scored 8.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable