{"id":"CVE-2026-12974","aliases":["EUVD-2026-85292","GHSA-6gj2-8x4x-4xwr"],"status":"published","title":"Security Policy Bypass in Forcepoint Security Engine (NGFW)","description":"A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW).\n\n\nThis issue affects Forcepoint Security Engine (NGFW): from 7.1.0 through 7.1.13, from 7.3.0 through 7.3.1, 7.3.3, from 7.4.0 through 7.4.1, and 7.5.0.","severity":{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:A","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00454,"percentile":0.39679,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1284","CWE-183"],"published":"2026-09-23T13:27:22Z","modified":"2026-09-23T17:58:26Z","products":[{"vendor":"forcepoint","product":"forcepoint security engine (ngfw)"}],"references":[{"url":"https://support.forcepoint.com/s/article/Security-Advisory-Security-Policy-Bypass-in-Forcepoint-Security-Engine-NGFW-CVE-2026-12974"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12974"},{"url":"https://github.com/advisories/GHSA-6gj2-8x4x-4xwr"}],"sources":{"cve":[{"id":"CVE-2026-12974","title":"Security Policy Bypass in Forcepoint Security Engine (NGFW)","description":"A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW).\n\n\nThis issue affects Forcepoint Security Engine (NGFW): from 7.1.0 through 7.1.13, from 7.3.0 through 7.3.1, 7.3.3, from 7.4.0 through 7.4.1, and 7.5.0.","status":"published","published":"2026-09-23T13:27:22.017Z","modified":"2026-09-23T15:23:50.227Z","cvss":[{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:A","level":"high","assessor":"cna"}],"cwes":["CWE-1284","CWE-183"],"updated_at":"2026-11-02T14:19:48.461833Z"}],"euvd":[{"id":"EUVD-2026-85292","description":"A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW).\n\n\nThis issue affects Forcepoint Security Engine (NGFW): from 7.1.0 through 7.1.13, from 7.3.0 through 7.3.1, 7.3.3, from 7.4.0 through 7.4.1, and 7.5.0.","status":"published","published":"2026-09-23T13:27:22Z","modified":"2026-09-23T15:23:50Z","cvss":[{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:A","level":"high"}],"updated_at":"2026-11-02T17:28:00.617613Z"}],"ghsa":[{"id":"GHSA-6gj2-8x4x-4xwr","title":"A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW).\n\n\nThis issue...","description":"A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW).\n\n\nThis issue affects Forcepoint Security Engine (NGFW): from 7.1.0 through 7.1.13, from 7.3.0 through 7.3.1, 7.3.3, from 7.4.0 through 7.4.1, and 7.5.0.","status":"published","published":"2026-09-23T15:30:48Z","modified":"2026-09-23T15:30:49Z","cvss":[{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-183"],"updated_at":"2026-11-02T15:12:20.494129Z"}],"nvd":[{"id":"CVE-2026-12974","description":"A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW).\n\n\nThis issue affects Forcepoint Security Engine (NGFW): from 7.1.0 through 7.1.13, from 7.3.0 through 7.3.1, 7.3.3, from 7.4.0 through 7.4.1, and 7.5.0.","status":"published","published":"2026-09-23T14:17:06.547Z","modified":"2026-09-23T17:58:26.57Z","cvss":[{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-183","CWE-1284"],"updated_at":"2026-11-02T14:12:50.703874Z"}]}}