Web Security and SSE
CVE-2023-26291: Cross-site scripting in Web Security, Cloud Security Gateway (CSG)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud (login_form.mhtml modules), Forcepoint Web Security Portal on Hybrid (login_form.mhtml modules) allows Reflected XSS.This issue affects Cloud Security Gateway (CSG): before 03/29/2023; Web Security: before 03/29/2023.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Cloud Security Gateway (CSG) (Web Cloud Security Gateway, Email Security Cloud) 0 | 03/29/2023 or later |
| Web Security (Hybrid) 0 | 03/29/2023 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud (login_form.mhtml modules), Forcepoint Web Security Portal on Hybrid (login_form.mhtml modules) allows Reflected XSS.This issue affects Cloud Security Gateway (CSG): before 03/29/2023; Web Security: before 03/29/2023.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 11 Oct 2026.