Is there a patch available for CVE-2026-0932?

Yes, a patch is available for CVE-2026-0932. Update the affected software to the latest version immediately.

M Files Server CVE-2026-0932

Q: What is the CVSS score of CVE-2026-0932?

CVE-2026-0932 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-17865 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-01 M-Files Corporation

GHSA-jm9p-6v87-5wr3

SSRF M Files Server

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.3.15818.5

EUVD ID Assigned

Apr 01, 2026 - 10:45 euvd

EUVD-2026-17865

Analysis Generated

Apr 01, 2026 - 10:45 vuln.today

CVE Published

Apr 01, 2026 - 10:03 nvd

MEDIUM 6.9

DescriptionCVE.org

Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated attacker to cause the server to send HTTP GET requests to arbitrary URLs.

AnalysisAI

Blind server-side request forgery in M-Files Server before version 26.3 allows unauthenticated remote attackers to force the server to send HTTP GET requests to arbitrary URLs through legacy connection methods in document co-authoring features. This vulnerability enables attackers to probe internal networks, access internal services, or trigger downstream attacks without requiring authentication, with a CVSS score of 6.9 reflecting moderate real-world impact.

Technical ContextAI

Server-side request forgery (SSRF) vulnerabilities, classified under CWE-918, occur when an application fetches remote resources based on user-supplied input without proper validation. In this case, the M-Files Server's legacy connection methods for document co-authoring fail to sanitize or restrict HTTP GET request destinations. The 'blind' variant means the attacker cannot directly observe the response from the forged request, but can still trigger server-side actions and infer results through timing, error messages, or side effects. The vulnerability exists in M-Files Server (CPE: cpe:2.3:a:m-files_corporation:m-files_server), a document collaboration platform, affecting all versions before 26.3.

RemediationAI

Vendor-released patch: M-Files Server 26.3 or later. Organizations should immediately upgrade to version 26.3 or higher to remediate the blind SSRF in legacy connection methods. The patch addresses the input validation defect in document co-authoring connection handling. For organizations unable to patch immediately, network segmentation should be implemented to restrict M-Files Server's outbound HTTP access to only necessary external destinations, and internal network services should require authentication to prevent unauthorized access via forged requests. Detailed remediation guidance and patch availability are documented in the vendor advisories at https://empower.m-files.com/security-advisories/CVE-2026-0932 and https://product.m-files.com/security-advisories/cve-2026-0932/.