PatchTheCVECVE-2019-7651: EPP.sys in Emsisoft Anti-Malware prior to version 2018.12 allows an attacker to bypass ACLs because Interprete
CVE-2019-7651 is a high-severity flaw (CVSS 7.5) affecting anti-malware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
EPP.sys in Emsisoft Anti-Malware prior to version 2018.12 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILE_DEVICE_SECURE_OPEN and therefore files and directories "inside" the \\.\EPP device are not properly protected, leading to unintended impersonation or object creation. This vulnerability has been fixed in version 2018.12 and later.
Why this priority
- High severity
- EPSS top 8%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 4.9% (top 8%) |
| CISA exploited list | No |
| Published | 2019-02-08 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-7651?
anti-malware: upgrade to newer than 2018.12. Exact commands for each OS are on this page.
Is CVE-2019-7651 being exploited?
CVE-2019-7651 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-7651 affect?
CVE-2019-7651 affects anti-malware. Severity is high (CVSS 7.5). EPP.sys in Emsisoft Anti-Malware prior to version 2018.12 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILE_DEVICE_SECURE_OPEN and therefore files and directories "inside" the \\.\EPP device are not pro
How urgent is CVE-2019-7651?
Priority 59/100. High severity; EPSS top 8%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2018-6627 HIGH 7.8 DOWNGRADE In WatchDog Anti-Malware 2.74.186.150, the driver file (ZAMGUARD32.SYS) allows local users to cause a denial o
- CVE-2018-6625 HIGH 7.8 DOWNGRADE In WatchDog Anti-Malware 2.74.186.150, the driver file (ZAMGUARD32.SYS) allows local users to cause a denial o
- CVE-2018-5714 HIGH 7.8 DOWNGRADE In Malwarefox Anti-Malware 2.72.169, the driver file (zam64.sys) allows local users to cause a denial of servi
- CVE-2018-5713 HIGH 7.8 DOWNGRADE In Malwarefox Anti-Malware 2.72.169, the driver file (zam64.sys) allows local users to cause a denial of servi
- CVE-2017-15921 HIGH 7.5 DOWNGRADE DOWNGRADE In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro 2.74.186.150, the zam32.sys driver contains a NU