CVE-2025-14026 Vulnerable Python version used in Forcepoint One DLP Client
Attackers can bypass Python ctypes restrictions in Forcepoint One DLP Client to execute arbitrary code via DLL calls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-14026?
CVE-2025-14026 is a high-severity vulnerability in Forcepoint One Endpoint (F1E), published on 6 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use of the ctypes library. ctypes is a foreign function interface (FFI) for Python, enabling calls to DLLs/shared libraries, memory allocation, and direct code execution. It was demonstrated that these restrictions could be bypassed.
Which versions are affected by CVE-2025-14026?
It affects 1 product.
Products include Forcepoint One Data Loss Prevention.
How do I fix CVE-2025-14026?
No fix has been published for CVE-2025-14026 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-14026 being exploited?
There is no known exploitation of CVE-2025-14026 in the wild and no public exploit code.
Sources
Also known as GHSA-j7p6-r384-7qp8.