Multi Model Server EUVD-2026-109112

Exploitation requires the attacker to reach the model download/registration path and supply a crafted model URL that the server will fetch; the SSRF then lets that fetch target internal network destinations. Per the vendor CVSS (PR:N/UI:N/AC:L), no authentication, user interaction, or special complexity is stated as required once that function is reachable. The primary limiting factor is network exposure of the model-management/download interface - whether it is reachable by the remote actor in a given deployment is not stated in the available sources and should be verified per environment. Impact is bounded to reading/inferring internal responses (C:L); there is no integrity or availability impact and no code execution described. Critically, no fixed version exists because the product is end-of-life - the vendor's only remediation is to discontinue use of Multi Model Server and migrate to a supported model-serving solution.

This is a medium-severity SSRF (CVSS 5.8, CWE-918) with the vendor-assigned vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N: network-reachable, low complexity, no authentication or user interaction, with a scope change reflecting that the attacker pivots requests into a separate internal trust boundary, but impact limited to confidentiality-low and no integrity or availability effect. The vuln.today decision label is 'this_month' - a real but non-emergency priority, not act_now/emergency. No EPSS score, no CISA KEV listing, no SSVC exploitation data, and no PoC or exploit reference are present in the input, so exploitation likelihood cannot be quantified and should not be assumed high; exploitation status is best described as no public exploit identified at time of analysis. The signals are internally consistent (medium CVSS, this_month label, no active-exploitation evidence) rather than conflicting. The one factor that can raise real-world impact beyond the raw score is context-specific: in AWS/cloud deployments an SSRF can target the instance metadata endpoint (169.254.169.254) to harvest credentials - but the CVSS only rates C:L and the advisory does not describe metadata access, so this is a defender consideration, not a confirmed capability. Key missing data: EPSS and any exploitation telemetry.

A remote actor who can reach the Multi Model Server model-registration/download function supplies a crafted model URL; the server then issues an outbound request to an attacker-chosen internal destination and returns or reflects aspects of that response, letting the attacker reach services that are not otherwise exposed. Given AV:N/AC:L/PR:N/UI:N, no authentication, special complexity, or victim interaction is required once that function is reachable. No public exploit code or PoC reference is present in the input.