CVE-2026-0932
Published: 01 April 2026
Summary
CVE-2026-0932 is a medium-severity SSRF (CWE-918) vulnerability in M-Files M-Files Server. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-0932 is a blind server-side request forgery (SSRF) vulnerability, mapped to CWE-918, in the legacy connection methods of document co-authoring features in M-Files Server versions before 26.3. Published on 2026-04-01T11:15:58.263, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The issue enables an unauthenticated attacker to cause the server to issue HTTP GET requests to arbitrary URLs.
An unauthenticated attacker can exploit this vulnerability over the network with low attack complexity and no user interaction. Exploitation tricks the server into originating requests to attacker-specified endpoints, potentially allowing access to internal resources, though blind SSRF limits direct response visibility to the attacker.
Mitigation details and patches are outlined in M-Files security advisories at https://empower.m-files.com/security-advisories/CVE-2026-0932 and https://product.m-files.com/security-advisories/cve-2026-0932/. Upgrading to M-Files Server 26.3 or later addresses the vulnerability in affected legacy features.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17865
Vulnerability details
Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated attacker to cause the server to send HTTP GET requests to arbitrary URLs.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Blind SSRF in public-facing M-Files Server directly enables exploitation of a public-facing application to issue requests against internal resources.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents blind SSRF by validating untrusted inputs to legacy document co-authoring connection methods that specify arbitrary URLs.
Enforces boundary protection to monitor and block unauthorized outbound HTTP GET requests to arbitrary internal or external destinations initiated by the server.
Ensures timely identification, reporting, and patching of the specific SSRF flaw in M-Files Server versions before 26.3 as recommended in security advisories.