This hotfix is included in VSE 8.8 Patch 4.
 

Patches are cumulative, so we recommend that you install the latest release. For information about the latest releases, see KB51111.
 

McAfee product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site at: https://www.mcafee.com/enterprise/en-us/downloads/my-products.html.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download Enterprise product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Background Information
The dynamic link library interfacing with the McAfee Agent for VSE property collection queries only the status of the McShield service. It interprets Running as enabled. This assumption is not necessarily accurate because the service might be running even though a failure leads to an inability to scan for threats.

The bEnabled property is used to reflect the status of the on-access scanner of VSE on end nodes within the ePolicy Orchestrator console. In VSE 8.7i and earlier, you could accurately obtain the status by checking the state of the McShield service, whether it is running or not. In version 8.8 and later, checking the state of the McShield service alone is insufficient. VSE 8.8 Hotfix 820636 improves the logic of what is examined to determine the on-access scanner status. It then reports the status accordingly using the same bEnabled property.  

bEnabled status: