CVE-2026-0932

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-01 · updated 2026-10-26
Weakness: CWE-918

Description

Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated attacker to cause the server to send HTTP GET requests to arbitrary URLs.

Affected products

M-Files Corporation M-Files Server: before 26.3.15818.5 — fixed in 26.3.15818.5

How to fix

Upgrade to a fixed version: M-Files Corporation M-Files Server 26.3.15818.5. Check the vendor advisory for mitigations.

References

https://empower.m-files.com/security-advisories/CVE-2026-0932
https://product.m-files.com/security-advisories/cve-2026-0932/

Get alerted when CVE-2026-0932 or the next vulnerability affects your stack