CVE-2025-14026: Forcepoint DLP Flaw Lets Attackers Unchain Restricted Python

CVE-2025-14026 is a high-severity vulnerability in the Forcepoint One DLP Client, disclosed in early January 2026, with a CVSS of 7.8. The flaw affects the client, specifically version 23.04.5642 and potentially others, which ships a bundled Python 2.5.4 runtime and initially attempted to constrain it by removing the ctypes library.

According to CERT/CC vulnerability notes, the restriction could be bypassed by attackers who reconstruct the ctypes FFI environment using their own compiled dependencies from another system, enabling the loading of ctypes and arbitrary code execution within the DLP client. The exploit involves transferring missing files and applying a version-header patch to the ctypes[.]pyd module, after which the patched module in the search path restores the Python environment’s capabilities.

Forcepoint’s response has been to remove the vulnerable runtime entirely, with affected Forcepoint One Endpoint builds released after version 23.11 (associated with Forcepoint DLP v10.2) no longer containing python.exe. The advisory warns that exploitation could allow data exfiltration, disable monitoring, or alter client behaviour on enterprise endpoints. according to CERT/CC