Web Security and SSE
CVE-2019-6146: It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, v…
It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host header injection.
Published
ExploitedNot in CISA KEV
Ransomware useNot reportedPer CISA
SeverityUnknown
EPSS3.0%Chance of exploitation in 30 days
Public exploitNot tracked
FixNot yet
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Forcepoint Web Security 8.5, 8 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 (Medium) (/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 11 Oct 2026.