CVE-2021-31832: McAfee Data Loss Prevention

Medium severity, CVSS 4.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Improper Neutralization of Input in the ePO administrator extension for McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a remote ePO DLP administrator to inject JavaScript code into the alert configuration text field. This JavaScript will be executed when an end user triggers a DLP policy on their machine.

Affected products

• McAfee Data Loss Prevention: before 11.6.200 (fixed in 11.6.200)

Published 2021-06-09. Last modified 2026-06-17.