Proofpoint Inc. is a security vendor whose vulnerability footprint centers on enterprise messaging, threat intelligence, and insider-risk management platforms that operate within or adjacent to critical email and data-loss workflows. The vendor's product portfolio is narrow, but its solutions occupy a high-trust position in security infrastructure, and vulnerabilities affecting these platforms skew toward serious outcomes, with a meaningful share reaching critical severity. The recurring weakness classes—including untrusted deserialization, cross-site scripting, missing authorization, and code injection—reflect the complexity of email parsing, user authentication, and policy enforcement in these security appliances. Defenders should treat Proofpoint advisories as high-priority for affected deployments and ensure timely patching of internet-reachable instances; current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Proofpoint Inc. over time
Of all the CVEs published by Proofpoint Inc. as a CNA, 86.4% affect products that Proofpoint Inc. develops as a vendor.
Of all the CVEs published that affect products developed by Proofpoint Inc., 43.2% are self-published by Proofpoint Inc. as a CNA.
Signals from CVEs in this vendor scope (44 CVEs).
44 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-46332CRITICAL The Admin Smart Search feature in Proofpoint Enterprise Protection (PPS/PoD) contains a stored cross-site scripting vulnerability that enables an anonymous email sender to gain adm | Dec 6, 2022 | 9.6 | 30 | NO | NO |
CVE-2020-10655CRITICAL The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouse API. The vulnerab | Jan 6, 2021 | 9.8 | 30 | NO | NO |
CVE-2023-0090CRITICAL The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'. Exploitati | Mar 8, 2023 | 9.8 | 29 | NO | NO |
CVE-2021-40842CRITICAL Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerability exists due to improper input validation on the database nam | Oct 13, 2021 | 9.8 | 29 | NO | NO |
CVE-2020-10656CRITICAL The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouseWithChunksV2 API. | Jan 6, 2021 | 9.8 | 29 | NO | NO |
CVE-2020-8884HIGH rcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT Windows Agent) before 7.9 allows remote authenticated users to execute arbitrary code as SYSTEM | Jan 6, 2021 | 8.8 | 28 | NO | NO |
CVE-2021-27900HIGH The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an authorization check on several pages in the Web Console. This enables a view-only user to | Apr 6, 2021 | 8.1 | 26 | NO | NO |
CVE-2019-19680HIGH A file-extension filtering vulnerability in Proofpoint Enterprise Protection (PPS / PoD), in the unpatched versions of PPS through 8.9.22 and 8.14.2 respectively, allows attackers | Jan 13, 2020 | 8.8 | 26 | NO | NO |
CVE-2023-0089HIGH
The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval injection'.
This affects | Mar 8, 2023 | 8.8 | 25 | NO | NO |
CVE-2022-46334HIGH Proofpoint Enterprise Protection (PPS/PoD) contains a vulnerability which allows the pps user to escalate to root privileges due to unnecessary permissions. This affects all versio | Dec 21, 2022 | 7.8 | 25 | NO | NO |
Signals from CVEs in this vendor scope (44 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Proofpoint Inc..
Media articles that mention a CVE ID that affects a product developed by Proofpoint Inc. — matched by CVE ID, not by vendor name.