Protection disablement via insufficient service anti-tampering

Incorrect authorization in Forcepoint One Endpoint before 22.01 allows local users with Administrator privileges to disable protection. Forcepoint has not disclosed the specific service-control authorization path; its anti-tampering controls fail to block administrator-driven service disablement. Administrator access on Microsoft Windows is required, and exploitation stops the endpoint software and the security enforcement it provides.