CVE-2024-10635: Enterprise Protection contains an improper input validation vulnerability in attachment defense that allows an unauthenticated remote attacker to bypass…

PriorityP431medium5.3CVSS 3.1

AVNACLPRNUINSUCNILAN

EPSS

0.25%

15.8th percentile

Enterprise Protection contains an improper input validation vulnerability in attachment defense that allows an unauthenticated remote attacker to bypass attachment scanning security policy by sending a malicious S/MIME attachment with an opaque signature. When opened by a recipient in a downstream email client, the malicious attachment could cause partial loss of integrity and confidentiality to their system.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
proofpoint	enterprise_protection	—	—
proofpoint	enterprise_protection	—	—
proofpoint	enterprise_protection	—	—
proofpoint	enterprise_protection	>= 8.18.6 < patch 5110	patch 5110
proofpoint	enterprise_protection	>= 8.20.6 < patch 5134	patch 5134
proofpoint	enterprise_protection	>= 8.21.0 < patch 5112	patch 5112

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.