CVE-2024-3676

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-14 · updated 2026-06-17
Weakness: CWE-20

Description

The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remote attacker with a specially crafted HTTP request to create additional Encryption user accounts under the attacker's control. These accounts are able to send spoofed email to any users within the domains configured by the Administrator.

Affected products

Proofpoint Enterprise Protection: from 8.18.6 before patch_4868; from 8.20.0 before patch_4869; from 8.20.2 before patch_4870 — fixed in patch_4868, patch_4869, patch_4870
Prootpoint Enterprise Protection: from 8.20.4 before patch_4871; from 8.21.0 before patch_4872 — fixed in patch_4871, patch_4872

How to fix

Upgrade to a fixed version: Proofpoint Enterprise Protection patch_4868, patch_4869, patch_4870; Prootpoint Enterprise Protection patch_4871, patch_4872. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-3676 or the next vulnerability affects your stack