CVE-2025-26487: Server Side Request Forgery (SSRF) in the web server of Infinera MTC-9

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-08 · updated 2026-10-07
Weakness: CWE-918

Description

Server-Side Request Forgery (SSRF) vulnerability in Infinera MTC-9 version allows remote unauthenticated users to gain access to other network resources using HTTPS requests through the appliance used as a bridge.

Affected products

Infinera MTC-9: from 22.1.1.0275 before 23.0 — fixed in 23.0

How to fix

Upgrade to a fixed version: Infinera MTC-9 23.0. Check the vendor advisory for mitigations.

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2025-26487

Get alerted when CVE-2025-26487 or the next vulnerability affects your stack