CVE-2014-2205: The Import and Export Framework in McAfee ePolicy Orchestrator (ePO) before 4.6.7 Hotfix 940148 allows remo...

Security readout for executives and security teams

This flaw affects older McAfee ePolicy Orchestrator installations. A logged-in user who can add dashboards could import malicious XML and make ePO read local server files. That can expose sensitive configuration or operational data from a central security management platform. Exposure is most likely in legacy McAfee ePO deployments older than 4.6.7 Hotfix 940148, especially where dashboard creation/import permissions are delegated beyond trusted administrators. Treat as a focused legacy-platform remediation item. It is not supported here as actively exploited, but ePO is a sensitive security management system and arbitrary file read can expose valuable internal data. Mitigation focus: Apply McAfee ePO 4.6.7 Hotfix 940148 or later vendor-recommended updates.; Restrict dashboard creation and import permissions to trusted ePO administrators.; Limit ePO administrative access to trusted management networks..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.