EUVD-2026-85292
GHSA-6gj2-8x4x-4xwr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, low-complexity policy bypass; scope change (S:C) because the NGFW is unharmed while protected downstream systems are exposed, with integrity of enforcement the primary impact.
Primary rating from Vendor (forcepoint).
CVSS VectorVendor: forcepoint
Lifecycle Timeline
4DescriptionCVE.org
A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW).
This issue affects Forcepoint Security Engine (NGFW): from 7.1.0 through 7.1.13, from 7.3.0 through 7.3.1, 7.3.3, from 7.4.0 through 7.4.1, and 7.5.0.
AnalysisAI
Security policy bypass in Forcepoint Security Engine (NGFW) versions 7.1.0 through 7.1.13, 7.3.0 through 7.3.1, 7.3.3, 7.4.0 through 7.4.1, and 7.5.0 allows unauthenticated network attackers to defeat the enforcement policy the appliance is supposed to apply to traffic passing through it. Because the appliance itself is not the target, impact falls on downstream systems that the NGFW is meant to protect - an attacker who exploits the flaw can make traffic the policy should block appear permitted, with high integrity impact on those subsequent systems (scope-changed). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to be a Forcepoint Security Engine (NGFW) running an affected version (7.1.0 through 7.1.13, 7.3.0 through 7.3.1, 7.3.3, 7.4.0 through 7.4.1, or 7.5.0) and deployed as an enforcement point with a security policy the bypass can defeat - the impact lands on systems the NGFW is meant to protect, not the appliance itself (vulnerable-system impact is N; only subsequent-system impact is H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority signal from a network-security appliance vendor, but several data points must be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No fixed version is specified in the provided intelligence, so the first action is to retrieve the exact patched release from Forcepoint's advisory at https://support.forcepoint.com/s/article/Security-Advisory-Security-Policy-Bypass-in-Forcepoint-Security-Engine-NGFW-CVE-2026-12974 and confirm with vendor support whether an upgrade path from 7.1.x, 7.3.x, 7.4.x, or 7.5.0 is available; until that is confirmed, treat the patch status as unverified rather than assuming a fix exists. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Forcepoint Security Engine (NGFW) appliances and confirm which run affected versions 7.1.0 through 7.1.13, 7.3.0 through 7.3.1, 7.3.3, 7.4.0 through 7.4.1, or 7.5.0, and identify which are enforcing policies protecting downstream systems; contact Forcepoint support for interim guidance because no vendor-released patch is identified at time of analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewa
Comodo Antivirus through 12.0.0.6870, Comodo Firewall through 12.0.0.6870, and Comodo Internet Security Premium through
In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as th
Multiple cross-site scripting (XSS) vulnerabilities in Endian Firewall 2.4 allow remote attackers to inject arbitrary we
Comodo Firewall Link Following Local Privilege Escalation Vulnerability. Rated high severity (CVSS 7.8), this vulnerabil
A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to
Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall ol
Stored cross-site scripting in the IPFire firewall distribution (versions before 2.29 Core Update 198) lets an authentic
Implicit intent hijacking vulnerability in Firewall application prior to versions 12.1.00.24 in Android 11, 13.1.00.16 i
Share
External POC / Exploit Code
Leaving vuln.today