Is CVE-2019-3654 actively exploited?

No active exploitation of CVE-2019-3654 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2019-3654 be exploited remotely?

No. CVE-2019-3654 requires local access to exploit.

What is the CVSS score of CVE-2019-3654?

CVE-2019-3654 has a CVSS score of 8.6 (HIGH).

HOME VULNERABILITIESCVE-2019-3654

HIGH

CVE-2019-3654

CWE-287Published: November 22, 2019· Updated: Jun 17, 2026

8.6

CVSS v3.1

Official Description

Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP) prior to 3.0.0 allows local user to bypass scanning of web traffic and gain access to blocked sites for a short period of time via generating an authorization key on the client which should only be generated by the network administrator.

NVD Source

Technical Analysis

CVE-2019-3654 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.6.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.