CVE-2023-26290

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-29 · updated 2026-06-17
Weakness: CWE-79

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud (login_reset_request.mhtml modules), Forcepoint Web Security Portal on Hybrid (login_reset_request.mhtml modules) allows Reflected XSS.This issue affects Cloud Security Gateway (CSG): before 03/29/2023; Web Security: before 03/29/2023.

Affected products

Forcepoint Cloud Security Gateway: before 2023-03-29 — fixed in 2023-03-29
Forcepoint Web Security: before 2023-03-29 — fixed in 2023-03-29

How to fix

Upgrade to a fixed version: Forcepoint Cloud Security Gateway 2023-03-29; Forcepoint Web Security 2023-03-29. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-26290 or the next vulnerability affects your stack