Is CVE-2022-0166 actively exploited?

No active exploitation of CVE-2022-0166 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-0166 be exploited remotely?

No. CVE-2022-0166 requires local access to exploit.

What is the CVSS score of CVE-2022-0166?

CVE-2022-0166 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2022-0166

HIGH

CVE-2022-0166

CWE-427Published: January 19, 2022· Updated: Jun 17, 2026

7.8

CVSS v3.1

Official Description

A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5. McAfee Agent uses openssl.cnf during the build process to specify the OPENSSLDIR variable as a subdirectory within the installation directory. A low privilege user could have created subdirectories and executed arbitrary code with SYSTEM privileges by creating the appropriate pathway to the specifically created malicious openssl.cnf file.

NVD Source

Technical Analysis

CVE-2022-0166 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.