CVE-2022-1700

CRITICAL

Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), ...

Affects 5 products across 1 vendor.

CVSS 3.19.8
EPSS0.8%
Percentile56th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-611: CWE-611
Related Attack Patterns (CAPEC)
CAPEC-221 Data Serialization External Entities Blowup
via CWE-611

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP) and related products, allowing attackers to exploit the XML parser for unauthorized data access or denial of service.

BSID: BS-2022-GLOBAL-324809-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-1700?
Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP) and related products, allowing attackers to exploit the XML parser for unauthorized data access or denial of service.
What is the CVSS score for CVE-2022-1700?
CVE-2022-1700 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.8%.
Is CVE-2022-1700 actively exploited?
No confirmed active exploitation of CVE-2022-1700 as of 2026-09-25.
How do I remediate CVE-2022-1700?
Priority: IMMEDIATE. Advisory: https://help.forcepoint.com/security/CVE/CVE-2022-1700.html PSIRT: [email protected]
What systems are affected by CVE-2022-1700?
CVE-2022-1700 affects Forcepoint Email Security, Data Loss Prevention, Web Security Content Gateway, Cloud Security Gateway, One Endpoint With Policy Engine.
Vulnerability Details
CVE IDCVE-2022-1700
BSIDBS-2022-GLOBAL-324809-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2022-09-12
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-611
SourceNVD
Official Description

Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20, 2022. The XML parser in the Policy Engine was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. This issue affects: Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2. Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2. Forcepoint Web Security Content Gateway versions prior to 8.5.5. Forcepoint Email Security with DLP enabled versions prior to 8.5.5. Forcepoint Cloud Security Gateway prior to June 20, 2022.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can craft a malicious XML payload that, when processed by the Policy Engine, can lead to XXE attacks. This can result in the disclosure of sensitive information, denial of service, or server-side request forgery.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Forcepoint Email Security < 8.5.5
Forcepoint Data Loss Prevention < 8.8.2
Forcepoint Web Security Content Gateway < 8.5.5
Forcepoint Cloud Security Gateway < 2022-06-20
Forcepoint One Endpoint With Policy Engine < 8.8.2
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1494 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash7d3f10da858c87f680e87a89bbaa9ae7199c267f198f9ff94d3bbfe474c40f299da03d706884a32167fd15b15deb7cb4d03483b76e7841e515aaea2f22a2e7da
Related CVEs affecting Forcepoint
CVE-2019-6139 9.8 Forcepoint User ID (FUID) server versions up to 1.2 have a remote arbitrary f... CVE-2018-16529 9.8 A password reset vulnerability has been discovered in Forcepoint Email Securi... CVE-2018-16530 9.8 A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows... CVE-2019-6140 9.8 A configuration issue has been discovered in Forcepoint Email Security 8.4.x ... CVE-2023-2080 9.8 Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje...
View all Forcepoint CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →