CVE-2026-11970

Severity: medium (CVSS 4.8 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-13 · updated 2026-10-23
Weakness: CWE-754

Description

This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E Mac OS before v26.04.5758.

Affected products

Forcepoint F1E mac: before v26.04.5758 — fixed in v26.04.5758

How to fix

Upgrade to a fixed version: Forcepoint F1E mac v26.04.5758. Check the vendor advisory for mitigations.

References

https://forcepoint2.my.site.com/ForcepointCustomerHub/s/article/Security-Advisory-Improper-Check-for-Unusual-or-Exceptional-Conditions-with-macOS-F1E-Endpoint-CVE-2026-11970

Get alerted when CVE-2026-11970 or the next vulnerability affects your stack