CVE-2020-14009

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-07 · updated 2026-06-17
Weakness: CWE-354

Description

Proofpoint Enterprise Protection (PPS/PoD) before 8.16.4 contains a vulnerability that could allow an attacker to deliver an email message with a malicious attachment that bypasses scanning and file-blocking rules. The vulnerability exists because messages with certain crafted and malformed multipart structures are not properly handled.

Affected products

Proofpoint Enterprise Protection: before 8.13.16; from 8.14.0 before 8.16.4 — fixed in 8.13.16, 8.16.4

How to fix

Upgrade to a fixed version: Proofpoint Enterprise Protection 8.13.16, 8.16.4. Check the vendor advisory for mitigations.

References

https://www.proofpoint.com/us/security/security-advisories
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0006
https://www.proofpoint.com/us/security/security-advisories
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0006

Get alerted when CVE-2020-14009 or the next vulnerability affects your stack