CVE-2009-3566: McAfee IntruShield Network Security Manager (NSM) before 5.1.11.8.1 does not include the HTTPOnly flag in t...

Security readout for executives and security teams

McAfee IntruShield Network Security Manager versions before 5.1.11.8.1 set session cookies without the HTTPOnly protection. If an attacker can also exploit a cross-site scripting flaw, they may steal an administrator’s session and act as that user. Exposure is limited to organizations still running McAfee IntruShield NSM earlier than 5.1.11.8.1, especially where the NSM interface is reachable by untrusted users or browsers. Treat as a cleanup and exposure-reduction item unless the NSM interface is broadly reachable. Prioritize promptly if legacy NSM manages critical security controls or is accessible from less-trusted networks. Mitigation focus: Upgrade McAfee IntruShield NSM to 5.1.11.8.1 or later where applicable.; Confirm current remediation guidance with the vendor or product maintainer.; Restrict access to the NSM management interface to trusted administrative networks..

Prepared

Jun 28, 2026, 18:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.