CVE-2026-115740 · Other
NO FIX YET
Versions 11.13.1 and earlier of the DLP on-prem extensions accept arbitrary UNC paths in the file prefix parameter of the OpenEventEvidenceFile.do endpoint without validation. The server opens the attacker-supplied path, so Windows initiates SMB authentication to an attacker-controlled host, which can expose credentials.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running the DLP on-prem extensions at version 11.13.1 or earlier are exposed, where the OpenEventEvidenceFile.do endpoint accepts requests. Systems that do not run this product or whose endpoint is not reachable by attackers can skip it. The sources do not say which fixed version resolves the issue.
Not affected if product-not-deployed
Who cares dlp, on-prem, windows
11.13.1OpenEventEvidenceFile.do endpoint is reachable from untrusted networksNo fix yet, per the sources.
Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix parameter in the OpenEventEvidenceFile.do endpoint accepts arbitrary UNC paths without validation. The server-side code attempts to open the specified file path, causing Windows to resolve the hostname and initiate SMB authentication to the attacker-controlled host.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.