CVE-2021-23888: McAfee Epolicy Orchestrator

Medium severity, CVSS 6.3. EPSS: 0.6% chance of exploitation in the next 30 days.

Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO user to load an untrusted site in an ePO iframe which could steal information from the authenticated user.

Affected products

• McAfee Epolicy Orchestrator: before 5.10.0 (fixed in 5.10.0); version 5.10.0 only

Published 2021-03-26. Last modified 2026-06-17.