{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/forcepoint/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:forcepoint:security_engine:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-12974"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Forcepoint Security Engine (NGFW) (7.1.0-7.1.13, 7.3.0-7.3.1, 7.33, 7.4.0-7.4.1, 7.5.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","network-security","patch-management"],"_cs_type":"advisory","_cs_vendors":["Forcepoint"],"content_html":"\u003cp\u003eForcepoint has released a security advisory concerning a critical security policy bypass vulnerability, identified as CVE-2026-12974, affecting the Forcepoint Security Engine (NGFW). The vulnerability impacts a range of software versions, specifically 7.1.0 to 7.1.13, 7.3.0 to 7.3.1, 7.33, 7.4.0 to 7.4.1, and 7.5.0. This flaw allows unauthorized modification or evasion of established network security policies enforced by the NGFW. Because the NGFW is a core component of perimeter and internal network traffic control, successful exploitation could permit attackers to bypass access controls, exfiltrate data, or facilitate lateral movement within the network. Defenders should immediately verify their NGFW version deployment and review the official Forcepoint support portal for relevant patches and remediation guidance.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-12974 enables unauthorized parties to bypass security policies enforced by Forcepoint Security Engine (NGFW). If left unpatched, this vulnerability could compromise network segmentation, expose internal assets, or allow attackers to bypass traffic filtering rules, potentially leading to unauthorized data access or network infiltration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately audit your environment for the affected Forcepoint Security Engine (NGFW) versions listed in this brief.\u003c/li\u003e\n\u003cli\u003eReview the official Forcepoint Security Advisory (CVE-2026-12974) via the Forcepoint Support Hub for available firmware updates and specific configuration workarounds.\u003c/li\u003e\n\u003cli\u003ePrioritize patching for internet-facing NGFW deployments that enforce critical perimeter security policies.\u003c/li\u003e\n\u003cli\u003eMonitor NGFW administrative logs for unauthorized or unexpected policy changes that may indicate exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-23T19:49:59Z","date_published":"2026-09-23T19:49:59Z","id":"https://feed.craftedsignal.io/briefs/2026-09-forcepoint-ngfw-bypass/","summary":"Forcepoint has disclosed CVE-2026-12974, a security policy bypass vulnerability affecting multiple versions of the Forcepoint Security Engine (NGFW) that requires urgent administrative review and patching.","title":"Security Policy Bypass in Forcepoint Security Engine (NGFW)","url":"https://feed.craftedsignal.io/briefs/2026-09-forcepoint-ngfw-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Forcepoint","version":"https://jsonfeed.org/version/1.1"}