EUVD-2026-57775
GHSA-6vvx-c6w6-g33q
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and low-privilege standard user account required; disabling a security extension yields low integrity and availability impact with no confidentiality exposure.
Primary rating from Vendor (forcepoint).
CVSS VectorVendor: forcepoint
Lifecycle Timeline
1DescriptionCVE.org
This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E Mac OS before v26.04.5758.
AnalysisAI
Forcepoint One Endpoint (F1E) on macOS prior to version v26.04.5758 allows any standard, non-administrative local user to disable the SafariExtension component that enforces Data Loss Prevention browser controls, effectively creating a blind spot in the organization's DLP posture. The CWE-754 root cause indicates the agent fails to properly validate exceptional or edge-case conditions when processing requests that alter the extension's operational state, permitting a low-privilege account to defeat a security control intended to require elevated rights. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local, non-administrative macOS user account on a system running Forcepoint One Endpoint prior to version v26.04.5758 with the SafariExtension component deployed and active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 4.8 accurately reflects the constrained threat model: exploitation is bounded to local access with low-privilege credentials, meaning an attacker must already have a foothold as a standard user on a managed macOS endpoint - remote unauthenticated exploitation is not possible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade Forcepoint One Endpoint on macOS to version v26.04.5758 or later, as specified in the vendor advisory at https://forcepoint2.my.site.com/ForcepointCustomerHub/s/article/Security-Advisory-Improper-Check-for-Unusual-or-Exceptional-Conditions-with-macOS-F1E-Endpoint-CVE-2026-11970. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today