Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Proofpoint Inc.

First CVE: Dec 31, 2004Active for: 22 yearsTotal CVEs: 44
30.6
VTI Score
Low

Proofpoint Inc. is a security vendor whose vulnerability footprint centers on enterprise messaging, threat intelligence, and insider-risk management platforms that operate within or adjacent to critical email and data-loss workflows. The vendor's product portfolio is narrow, but its solutions occupy a high-trust position in security infrastructure, and vulnerabilities affecting these platforms skew toward serious outcomes, with a meaningful share reaching critical severity. The recurring weakness classes—including untrusted deserialization, cross-site scripting, missing authorization, and code injection—reflect the complexity of email parsing, user authentication, and policy enforcement in these security appliances. Defenders should treat Proofpoint advisories as high-priority for affected deployments and ensure timely patching of internet-reachable instances; current exploitation activity and exposure counts are shown alongside this summary.

FAUCET AI Generated
44
Total CVEs
More Total CVEs than 98% of tracked vendors
0.6
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 9% of tracked vendors
6.9
Avg CVSS Score
Higher Avg CVSS Score than 49% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Proofpoint Inc. over time

Volume of CVEsAvg CVSS Base Score
First CVE
Dec 31, 2004
21 years ago
Most Recent CVE
Nov 3, 2025
263 days ago

Self-Reporting Analysis

Of all the CVEs published by Proofpoint Inc. as a CNA, 86.4% affect products that Proofpoint Inc. develops as a vendor.

86.4%
13.6%
Self-reported: 19 (86.4%)
Third-party: 3 (13.6%)

Of all the CVEs published that affect products developed by Proofpoint Inc., 43.2% are self-published by Proofpoint Inc. as a CNA.

43.2%
56.8%
Self-published: 19 (43.2%)
Other CNAs: 25 (56.8%)

Products(9 total)

Top CVEs

Signals from CVEs in this vendor scope (44 CVEs).

44 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2022-46332CRITICAL
The Admin Smart Search feature in Proofpoint Enterprise Protection (PPS/PoD) contains a stored cross-site scripting vulnerability that enables an anonymous email sender to gain adm
Dec 6, 20229.630NONO
CVE-2020-10655CRITICAL
The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouse API. The vulnerab
Jan 6, 20219.830NONO
CVE-2023-0090CRITICAL
The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'. Exploitati
Mar 8, 20239.829NONO
CVE-2021-40842CRITICAL
Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerability exists due to improper input validation on the database nam
Oct 13, 20219.829NONO
CVE-2020-10656CRITICAL
The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouseWithChunksV2 API.
Jan 6, 20219.829NONO
CVE-2020-8884HIGH
rcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT Windows Agent) before 7.9 allows remote authenticated users to execute arbitrary code as SYSTEM
Jan 6, 20218.828NONO
CVE-2021-27900HIGH
The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an authorization check on several pages in the Web Console. This enables a view-only user to
Apr 6, 20218.126NONO
CVE-2019-19680HIGH
A file-extension filtering vulnerability in Proofpoint Enterprise Protection (PPS / PoD), in the unpatched versions of PPS through 8.9.22 and 8.14.2 respectively, allows attackers
Jan 13, 20208.826NONO
CVE-2023-0089HIGH
The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval injection'. This affects
Mar 8, 20238.825NONO
CVE-2022-46334HIGH
Proofpoint Enterprise Protection (PPS/PoD) contains a vulnerability which allows the pps user to escalate to root privileges due to unnecessary permissions. This affects all versio
Dec 21, 20227.825NONO
View all 44 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products44 CVEs
43%
41%
14%
Severity distribution among all CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local5 (11.4%)
Network26 (59.1%)
Unknown6 (13.6%)
Physical0 (0.0%)
Adjacent Network7 (15.9%)
Attack Complexity
Low33 (75.0%)
High5 (11.4%)
Unknown6 (13.6%)
User Interaction
None27 (61.4%)
Unknown6 (13.6%)
Required11 (25.0%)
Privileges Required
Low10 (22.7%)
High6 (13.6%)
None22 (50.0%)
Unknown6 (13.6%)

Exploit Exposure

Signals from CVEs in this vendor scope (44 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Proofpoint Inc..

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Proofpoint Inc. — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Proofpoint Inc.'s Products

View all 2 CNAs →

Top CWEs