A vulnerability in the Forcepoint One Endpoint client allows a local, authenticated user to bypass security restrictions and achieve arbitrary code execution.

This vulnerability involves the use of an unmaintained and restricted Python component that fails to prevent the use of the ctypes library, which is a foreign function interface that enables direct memory access and arbitrary code execution. The attack requires a local user with low privileges to trigger the bypass.

The ability to bypass security restrictions and execute arbitrary code on an endpoint allows an attacker to gain full control over the compromised machine. Given the CVSS score of 7.8, this represents a high risk to organizational data confidentiality, integrity, and availability, particularly as the software is designed for security and data loss prevention. Unauthorized access to these endpoints could lead to the exfiltration of sensitive data or the deployment of further malicious payloads.

Immediate Action: Review the official Forcepoint support article 000042256 and apply the recommended security updates or configuration changes provided by the vendor.

Proactive Monitoring: Monitor endpoint logs for unusual child processes spawning from the Forcepoint One Endpoint service or unexpected execution of Python-related scripts.

Compensating Controls: Ensure that endpoint security policies strictly enforce the principle of least privilege, limiting the ability of standard users to execute arbitrary code or interact with system-level binaries.

Public Exploit Available: Unknown.

This vulnerability presents a significant risk due to its potential for total system compromise on affected endpoints. Administrators should prioritize patching the Forcepoint One Endpoint software immediately upon the release of a fix by the vendor, as local access to the system facilitates this attack. In the interim, ensure that user permissions on sensitive workstations are restricted to prevent the exploitation of local code execution flaws.