CVE-2024-3676

7.5 highEPSS 0.4%

High (7.5). EPSS 0.4% chance of exploitation in the next 30 days.

The Proofpoint Encryption endpoint of Proofpoint Enterprise Protection contains an Improper Input Validation vulnerability that allows an unauthenticated remote attacker with a specially crafted HTTP request to create additional Encryption user accounts under the attacker's control. These accounts are able to send spoofed email to any users within the domains configured by the Administrator.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2024-05-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2024-0002
https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2024-0002

Check your stack JSON