CVE-2020-6590: Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to infor

Q: How do I fix CVE-2020-6590?

data loss prevention: upgrade to 8.7.1; email security: upgrade to 8.5.4; web security content gateway: upgrade to 8.5.4. Exact commands for each OS are on this page.

Q: Is CVE-2020-6590 being exploited?

CVE-2020-6590 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2020-6590 affect?

CVE-2020-6590 affects data loss prevention, email security, web security content gateway. Severity is high (CVSS 7.5). Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure.

Q: How urgent is CVE-2020-6590?

Priority 48/100. High severity; Remotely exploitable, no login, no user action

This month

HIGH 7.5REMOTEUPGRADEUPGRADEUPGRADE

CVE-2020-6590 is a high-severity flaw (CVSS 7.5) affecting data loss prevention, email security, web security content gateway. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure.

Why this priority

High severity
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.1% (top 35%)
CISA exploited list	No
Weakness	CWE-611
Published	2021-04-08
Last modified	2026-06-17

Publisher (CNA): Forcepoint · Vendor: forcepoint

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2021-04-08 22:15 UTCPublished CVE record published
2026-06-17 03:23 UTCUpdated Record last modified

forcepoint data loss prevention UPGRADE

Affected: < 8.7.1

Fixed in: 8.7.1

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy data-loss-prevention || rpm -q data-loss-prevention || data-loss-prevention --version

2. UPGRADE to 8.7.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade data-loss-prevention

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade data-loss-prevention

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

forcepoint email security UPGRADE

Affected: < 8.5.4

Fixed in: 8.5.4

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy email-security || rpm -q email-security || email-security --version

2. UPGRADE to 8.5.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade email-security

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade email-security

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

forcepoint web security content gateway UPGRADE

Affected: < 8.5.4

Fixed in: 8.5.4

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy web-security-content-gateway || rpm -q web-security-content-gateway || web-security-content-gateway --version

2. UPGRADE to 8.5.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade web-security-content-gateway

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade web-security-content-gateway

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-6590?

data loss prevention: upgrade to 8.7.1; email security: upgrade to 8.5.4; web security content gateway: upgrade to 8.5.4. Exact commands for each OS are on this page.

Is CVE-2020-6590 being exploited?

CVE-2020-6590 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-6590 affect?

CVE-2020-6590 affects data loss prevention, email security, web security content gateway. Severity is high (CVSS 7.5). Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure.

How urgent is CVE-2020-6590?

Priority 48/100. High severity; Remotely exploitable, no login, no user action

Related CVEs

CVE-2023-4814 HIGH 7.1 DOWNGRADE A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused t
CVE-2023-0400 MEDIUM 5.9 UPGRADE The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0
CVE-2022-1700 HIGH 7.5 UPGRADE UPGRADE Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint
CVE-2021-4088 HIGH 8.4 UPGRADE SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior
CVE-2021-31832 MEDIUM 5.2 UPGRADE Improper Neutralization of Input in the ePO administrator extension for McAfee Data Loss Prevention (DLP) Endp

References

← Back to latest CVEs