Forcepoint
25 CVEs across 36 Forcepoint products. Browse Forcepoint vulnerabilities, severities, and proof-of-concept exploits.
Forcepoint products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11970 | | 2026-08-13 | This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E Mac OS before v26.0… | |
CVE-2025-12694 | High | 7.8 | 2026-06-04 | A local privilege escalation vulnerability exists in Forcepoint VPN Client that allows a local non-administrative user to escalate privileges to SYSTEM. This i… |
CVE-2025-2274 | Medium | 6.1 | 2026-03-16 | Improper Neutralization of Input During Web Page Generation in Forcepoint Web Security (On-Prem) on Windows allows Stored XSS.This issue affects Web Security t… |
CVE-2025-12690 | High | 7.8 | 2026-03-11 | Execution with unnecessary privileges in Forcepoint NGFW Engine allows local privilege escalation.This issue affects NGFW Engine through 6.10.19, through 7.3.0… |
CVE-2025-14026 | High | 7.8 | 2026-01-06 | Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use of the ctypes libr… |
CVE-2025-2272 | High | 7.0 | 2025-05-22 | Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issu… |
CVE-2024-9103 | Medium | 6.1 | 2025-03-24 | Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS. This issu… |
CVE-2024-2166 | High | 8.8 | 2024-09-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time Monitor modules) all… |
CVE-2023-6452 | Critical | 9.6 | 2024-08-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction Viewer) allows Store… |
CVE-2023-5451 | Medium | 6.1 | 2024-03-04 | Forcepoint NGFW Security Management Center Management Server has SMC Downloads optional feature to offer standalone Management Client downloads and ECA conf… |
CVE-2023-1705 | High | 8.4 | 2024-01-29 | Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escalation, Functionality… |
CVE-2023-2080 | High | 8.5 | 2023-06-15 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Clo… |
CVE-2023-26292 | Medium | 6.1 | 2023-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Clo… |
CVE-2023-26291 | Medium | 6.1 | 2023-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Clo… |
CVE-2023-26290 | Medium | 6.1 | 2023-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Clo… |
CVE-2022-1700 | High | 7.5 | 2022-09-12 | Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also levera… |
CVE-2022-27609 | Medium | 6.0 | 2022-04-04 | Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide sufficient anti-tampering protection of services by users with A… |
CVE-2022-27608 | Medium | 6.0 | 2022-04-04 | Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with Administrator privileges. T… |
CVE-2021-41530 | High | 7.5 | 2021-10-04 | Forcepoint NGFW Engine versions 6.5.11 and earlier, 6.8.6 and earlier, and 6.10.0 are vulnerable to TCP reflected amplification vulnerability, if HTTP User Res… |
CVE-2020-6590 | High | 7.5 | 2021-04-08 | Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure. |
CVE-2019-6146 | Medium | 6.1 | 2020-01-22 | It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 (Medium) (/A… |
CVE-2019-6147 | Medium | 5.9 | 2019-12-23 | Forcepoint NGFW Security Management Center (SMC) versions lower than 6.5.12 or 6.7.1 have a rare issue that in specific circumstances can corrupt the internal… |
CVE-2019-6142 | Medium | 6.1 | 2019-11-05 | It has been reported that XSS is possible in Forcepoint Email Security, versions 8.5 and 8.5.3. It is strongly recommended that you apply the relevant hotfix i… |
CVE-2019-6144 | Medium | 6.5 | 2019-10-23 | This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint (versions 19.04 through 19.08) and bypass DLP and Web protection. |
CVE-2019-6145 | Medium | 6.7 | 2019-09-20 | Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user… |
CVE-2019-6143 | Critical | 9.1 | 2019-08-20 | Forcepoint Next Generation Firewall (Forcepoint NGFW) 6.4.x before 6.4.7, 6.5.x before 6.5.4, and 6.6.x before 6.6.2 has a serious authentication vulnerability… |
CVE-2019-6140 | Critical | 9.8 | 2019-04-09 | A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnerable state if the hybrid registration pr… |
CVE-2018-16530 | Critical | 9.8 | 2019-04-09 | A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows an attacker to craft malicious input and potentially crash a process creating a d… |
CVE-2018-16529 | Critical | 9.8 | 2019-03-28 | A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. The password reset URL can be used after the intended expiration period… |
CVE-2019-6139 | Critical | 9.8 | 2019-02-07 | Forcepoint User ID (FUID) server versions up to 1.2 have a remote arbitrary file upload vulnerability on TCP port 5001. Successful exploitation of this vulnera… |
CVE-2004-0112 | | 2004-11-23 | The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets du… |