M Files Server EUVD-2026-17865

The CVSS vector indicates an unauthenticated network-based attack with low complexity and no user interaction required (AV:N, AC:L, PR:N, UI:N), resulting in low confidentiality and integrity impact (VC:L, VI:L) but no availability impact. The lack of confidentiality and integrity effects in the CVSS vector suggests this SSRF is primarily useful for internal network reconnaissance rather than direct data exfiltration. However, real-world SSRF severity depends on the internal network architecture: in organizations where internal services lack network segmentation, this could enable attacks on internal APIs, cloud metadata services (AWS/Azure/GCP), or cached resources. The 6.9 CVSS score reflects a moderate threat, but the actual exploitability is elevated by the complete lack of authentication requirements. No KEV (CISA Known Exploited Vulnerabilities) status or public proof-of-concept availability is indicated in the provided data, suggesting this is not yet actively exploited in the wild at time of analysis, which reduces immediate priority relative to confirmed actively exploited vulnerabilities.

An attacker without authentication sends a crafted request to a vulnerable M-Files Server instance, specifying an internal URL (e.g., http://192.168.1.50:8080/admin) or a cloud metadata endpoint (e.g., http://169.254.169.254/latest/meta-data/) as the target. The server processes the request and issues an HTTP GET to that destination, allowing the attacker to map the internal network, discover running services, or potentially retrieve sensitive metadata. Because the SSRF is blind, the attacker may infer success through timing differences, error handling responses, or by chaining the vulnerability with other attacks. No public exploit code is referenced in available data at time of analysis.