EUVD-2026-57775
GHSA-6vvx-c6w6-g33q
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector and low-privilege standard user account required; disabling a security extension yields low integrity and availability impact with no confidentiality exposure.
Primary rating from Vendor (forcepoint).
CVSS VectorVendor: forcepoint
Lifecycle Timeline
1DescriptionCVE.org
This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E Mac OS before v26.04.5758.
AnalysisAI
Forcepoint One Endpoint (F1E) on macOS prior to version v26.04.5758 allows any standard, non-administrative local user to disable the SafariExtension component that enforces Data Loss Prevention browser controls, effectively creating a blind spot in the organization's DLP posture. The CWE-754 root cause indicates the agent fails to properly validate exceptional or edge-case conditions when processing requests that alter the extension's operational state, permitting a low-privilege account to defeat a security control intended to require elevated rights. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Technical ContextAI
Forcepoint One Endpoint is an enterprise unified endpoint security agent that enforces DLP policies across managed devices. On macOS, a Safari browser extension component intercepts and inspects browser-based data transfers to enforce policy controls against unauthorized data exfiltration. CWE-754 (Improper Check for Unusual or Exceptional Conditions) indicates the agent's extension management logic does not correctly guard against unexpected input states or control-flow paths that a normal user can trigger - the component responsible for maintaining extension state does not enforce that only privileged actors (admin-level processes or users) can modify it. The CVSS 4.0 base vector (AV:L/AC:L/AT:N/PR:L/UI:N) is consistent with this analysis: the attack is fully local, requires no attack-surface-specific prerequisite (AT:N), and is achievable by a standard user account without user interaction. No CPE strings were provided in the source data; the affected product boundary is defined as F1E Mac OS versions prior to v26.04.5758.
RemediationAI
The primary remediation is to upgrade Forcepoint One Endpoint on macOS to version v26.04.5758 or later, as specified in the vendor advisory at https://forcepoint2.my.site.com/ForcepointCustomerHub/s/article/Security-Advisory-Improper-Check-for-Unusual-or-Exceptional-Conditions-with-macOS-F1E-Endpoint-CVE-2026-11970. Where immediate patching is operationally constrained, organizations should implement MDM-enforced controls (for example, via Jamf Pro or Microsoft Intune for macOS) to mandate and restore the SafariExtension configuration, monitor F1E agent logs for unexpected extension state changes, and alert on any session where the DLP browser extension becomes inactive. Restricting standard user accounts from modifying system extension settings through macOS System Extension policy profiles provides an additional compensating layer, though this does not address the underlying CWE-754 defect and should not substitute for patching.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today