CVE-2017-3898: A man-in-the-middle attack vulnerability in the non-certificate-based authentication mechanism in McAfee Li...

Security readout for executives and security teams

McAfee LiveSafe before 16.0.3 had an update communication weakness. A network attacker positioned between the device and McAfee’s update backend could tamper with an HTTP response and change a Windows registry value tied to updates. The bundle does not provide severity, CVSS, or evidence of active exploitation. Exposure appears limited to Windows systems running McAfee LiveSafe versions prior to 16.0.3. Risk is most relevant where attackers can intercept or alter network traffic used for update communications. The bundle does not identify other McAfee products as affected. Treat this as a targeted legacy endpoint risk. It is not listed in KEV and lacks a severity score, but affected systems should be upgraded because update-path tampering can weaken endpoint protection trust. Mitigation focus: Confirm whether McAfee LiveSafe is present and below version 16.0.3.; Update McAfee LiveSafe to 16.0.3 or later where applicable.; Check McAfee’s vendor advisory for supported remediation guidance..

Prepared

Jun 12, 2026, 21:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.