Forcepoint vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-12974 A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW).High 7.9 · Sep 23, 2026
• CVE-2025-12694 A local privilege escalation vulnerability exists in Forcepoint VPN Client that allows a local non-administrative user to escalate privileges to SYSTEM.High 8.5 · Jun 4, 2026
• CVE-2025-12690 Execution with unnecessary privileges in Forcepoint NGFW Engine allows local privilege escalation.This issue affects NGFW Engine through 6.10.19, through 7.3.0,High 7.3 · Mar 11, 2026
• CVE-2025-14026 Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use of the ctypes libraHigh 7.8 · Jan 6, 2026
• CVE-2025-2272 Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issueHigh 7.3 · May 22, 2025
• CVE-2024-2166 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time Monitor modules) alloHigh 8.8 · Sep 4, 2024
• CVE-2023-6452 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction Viewer) allows StoredCritical 9.6 · Aug 22, 2024
• CVE-2023-1705 Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escalation, Functionality High 8.4 · Jan 29, 2024
• CVE-2023-2080 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web ClouHigh 8.5 · Jun 15, 2023
• CVE-2022-1700 Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveragHigh 7.5 · Sep 12, 2022
• CVE-2021-41530 Forcepoint NGFW Engine versions 6.5.11 and earlier, 6.8.6 and earlier, and 6.10.0 are vulnerable to TCP reflected amplification vulnerability, if HTTP User RespHigh 7.5 · Oct 4, 2021
• CVE-2020-6590 Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure.High 7.5 · Apr 8, 2021
• CVE-2019-6143 Forcepoint Next Generation Firewall (Forcepoint NGFW) 6.4.x before 6.4.7, 6.5.x before 6.5.4, and 6.6.x before 6.6.2 has a serious authentication vulnerability Critical 9.1 · Aug 20, 2019
• CVE-2019-6140 A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnerable state if the hybrid registration proCritical 9.8 · Apr 9, 2019
• CVE-2018-16530 A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows an attacker to craft malicious input and potentially crash a process creating a deCritical 9.8 · Apr 9, 2019
• CVE-2018-16529 A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x.Critical 9.8 · Mar 28, 2019
• CVE-2019-6139 Forcepoint User ID (FUID) server versions up to 1.2 have a remote arbitrary file upload vulnerability on TCP port 5001.Critical 9.8 · Feb 7, 2019