CVE-2018-16529

CRITICAL

A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. The password reset URL can be used after the intended expiration period or after the URL has already been used...

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS1.6%
Percentile75th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-640: CWE-640
Related Attack Patterns (CAPEC)
CAPEC-50 Password Recovery Exploitation
via CWE-640

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2019. A critical vulnerability affects Forcepoint systems (CVE-2018-16529). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2019-GLOBAL-126450-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2018-16529?
This vulnerability was disclosed in 2019. A critical vulnerability affects Forcepoint systems (CVE-2018-16529). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2018-16529?
CVE-2018-16529 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.6%.
Is CVE-2018-16529 actively exploited?
No confirmed active exploitation of CVE-2018-16529 as of 2026-05-30.
How do I remediate CVE-2018-16529?
Priority: MEDIUM. Advisory: https://help.forcepoint.com/security/CVE/CVE-2018-16529.html PSIRT: [email protected]
What systems are affected by CVE-2018-16529?
CVE-2018-16529 affects Forcepoint Email Security.
Vulnerability Details
CVE IDCVE-2018-16529
BSIDBS-2019-GLOBAL-126450-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2019-03-28
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
CWE-640
SourceNVD
Official Description

A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. The password reset URL can be used after the intended expiration period or after the URL has already been used to reset a password.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. The password reset URL can be used after the intended expiration period or after the URL has already been used to reset a password. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Exploitation Likelihood: LOW

Affected Products
VendorProductAffected Versions
Forcepoint Email Security ≥ 8.5.0, ≤ 8.5.3
Remediation
View Vendor Advisory →

Remediation Priority: MEDIUM

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2758 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash9a779a57f1a7bf095066cfcc0e1732d51484f98b157a712f859c58f5eb9efe506bb3496d4693670fb0f47bcb604a575acfb5c73bd7264ac94a3b271ee32365b7
Related CVEs affecting Forcepoint
CVE-2022-1700 9.8 Improper Restriction of XML External Entity Reference ('XXE') vulnerability i... CVE-2018-16530 9.8 A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows... CVE-2019-6140 9.8 A configuration issue has been discovered in Forcepoint Email Security 8.4.x ... CVE-2019-6139 9.8 Forcepoint User ID (FUID) server versions up to 1.2 have a remote arbitrary f... CVE-2023-2080 9.8 Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje...
View all Forcepoint CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →