CVE-2015-8986

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Sandbox detection evasion vulnerability in hardware appliances in McAfee (now Intel Security) Advanced Threat Defense (MATD) 3.4.2.32 and earlier allows attackers to detect the sandbox environment, then bypass proper malware detection resulting in failure to detect a malware file (false-negative) via specially crafted malware.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-254

Affected software

Vendor	Product	Versions
Intel	Advanced Threat Defense (MATD)	3.4.2.32 and earlier

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10096Mitigation, Vendor Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10096Mitigation, Vendor Advisory

Timeline

Published: Mar 14, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-89875.3Man-in-the-middle (MitM) attack vulnerability in non-Mac OS agents in McAfee (now Intel Security) Agent (MA) 4.8.0 patch 2 and earlier allow CVE-2015-89888.8Unquoted executable path vulnerability in Client Management and Gateway components in McAfee (now Intel Security) ePO Deep Command (eDC) 2.2 CVE-2015-89898.8Unsalted password vulnerability in the Enterprise Manager (web portal) component in Intel Security McAfee Vulnerability Manager (MVM) 7.5.8 CVE-2015-89907.5Detection bypass vulnerability in Intel Security Advanced Threat Defense (ATD) 3.4.6 and earlier allows malware samples to bypass ATD detect CVE-2015-89917.0Malicious file execution vulnerability in Intel Security McAfee Security Scan+ (MSS+) before 3.11.266.3 allows attackers to make the product CVE-2015-89927.0Malicious file execution vulnerability in Intel Security WebAdvisor before 4.0.2, 4.0.1 and 3.7.2 allows attackers to make the product momen CVE-2015-89937.0Malicious file execution vulnerability in Intel Security CloudAV (Beta) before 0.5.0.151.3 allows attackers to make the product momentarily CVE-2015-89947.5An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with OpCache enabled. With 5.x aft CVE-2015-89957.8In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.CVE-2015-89967.0In TrustZone a time-of-check time-of-use race condition could potentially exist in a QFPROM routine in all Android releases from CAF using t CVE-2015-89977.0In TrustZone a time-of-check time-of-use race condition could potentially exist in a listener routine in all Android releases from CAF using CVE-2015-89987.8In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.