PT-2026-25753 · Forcepoint · Web Security

Published 2026-03-16 · Updated 2026-03-16 · CVE-2025-2274

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Forcepoint Web Security (On-Prem) versions through 8.5.6

Description The software contains a flaw due to improper neutralization of input during web page generation, leading to a Stored Cross-Site Scripting (XSS) condition. This allows an attacker to inject malicious scripts into web pages viewed by other users. The issue impacts the Web Security product on Windows systems.

Recommendations Update Forcepoint Web Security (On-Prem) to a version later than 8.5.6.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-2274

Affected Products

Web Security

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-2274 · Security Note
• https://twitter.com/CVEnew/status/2033583626097725809 · Twitter Post
• https://support.forcepoint.com/s/article/Security-Advisory-Stored-Cross-Site-Scripting-in-Forcepoint-Web-Security · Note