Email Protection
CVE-2024-3676: The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation in Enterprise Protection
The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remote attacker with a specially crafted HTTP request to create additional Encryption user accounts under the attacker's control.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Enterprise Protection 8.18 | patch 4868 or later |
| Enterprise Protection 8.20 | patch 4869 or later |
| Enterprise Protection 8.20 | patch 4870 or later |
| Enterprise Protection 8.20 | patch 4871 or later |
| Enterprise Protection 8.21 | patch 4872 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remote attacker with a specially crafted HTTP request to create additional Encryption user accounts under the attacker's control. These accounts are able to send spoofed email to any users within the domains configured by the Administrator.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 11 Oct 2026.