Web Security and SSE
CVE-2024-9103: Persistent XSS in blocked messages
Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS.
Published
ExploitedNot in CISA KEV
Ransomware useNot reportedPer CISA
SeverityMEDIUMCVSS 3.1 6.1
EPSS0.23%Chance of exploitation in 30 days
Public exploitNot tracked
FixNot yet
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Email Security 0 to 8.5.5 | Upgrade past 8.5.5; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS. This issue affects Email Security through 8.5.5.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 11 Oct 2026.