CVE-2026-19233

Awaiting Analysis Awaiting Analysis - Queue

Server-Side Request Forgery in SE Application

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: Schneider Electric SE

Description

CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, unvalidated parameters to a server endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-19233

EUVD

EUVD-2026-75105

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability where an attacker with a privileged account can send crafted, unvalidated parameters to a server endpoint. This could lead to unauthorized command execution and disclosure of server data.

Detection Guidance

SSRF detection involves monitoring server requests for unusual internal or external resource access. Check web server logs for suspicious URLs containing localhost, internal IP addresses, or file protocols. Use tools like curl or wget to test endpoints with crafted parameters pointing to internal services. Network monitoring tools can detect unexpected outbound connections from the server.

Impact Analysis

An attacker could exploit this to execute unauthorized commands on the server, access sensitive data, or perform actions as the server. This may result in data breaches, system compromise, or further network infiltration.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy). Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Implement strict input validation for all server endpoints to prevent crafted parameters. Use allowlists for allowed server-side requests and disable unused protocols. Apply network segmentation to limit server access to trusted systems only.

Hi! I’m here to help you understand CVE-2026-19233. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70