{"id":"CVE-2026-115740","kind":"vulnerability","aliases":["CVE-2026-115740"],"related":[],"title":"DLP on-prem extensions: SSRF via UNC file path lets server leak SMB credentials","description":"Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix parameter in the OpenEventEvidenceFile.do endpoint accepts arbitrary UNC paths without validation. The server-side code attempts to open the specified file path, causing Windows to resolve the hostname and initiate SMB authentication to the attacker-controlled host.","summary":"Versions 11.13.1 and earlier of the DLP on-prem extensions accept arbitrary UNC paths in the file prefix parameter of the OpenEventEvidenceFile.do endpoint without validation. The server opens the attacker-supplied path, so Windows initiates SMB authentication to an attacker-controlled host, which can expose credentials.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dlp","on-prem","other","windows"],"not_affected_if":["product-not-deployed"],"how_to_check":"- Check the installed DLP on-prem extensions version against `11.13.1`\n- Review whether the `OpenEventEvidenceFile.do` endpoint is reachable from untrusted networks","fix":null,"status":"open","published_at":"2026-11-05T16:17:34+00:00","first_seen_at":"2026-11-05T16:40:01+00:00","triaged_at":"2026-11-05T16:41:49+00:00","updated_at":"2026-11-05T16:41:49+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-05T16:41:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"DLP on-prem extensions: SSRF via UNC file path lets server leak SMB credentials","impact":"medium","summary":"Versions 11.13.1 and earlier of the DLP on-prem extensions accept arbitrary UNC paths in the file prefix parameter of the OpenEventEvidenceFile.do endpoint without validation. The server opens the attacker-supplied path, so Windows initiates SMB authentication to an attacker-controlled host, which can expose credentials.","audience":"businesses","category":"other","nicknames":[],"who_cares":["dlp","windows","on-prem"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"server authenticates over SMB to attacker host, leaking credentials","analyst_note":"Confirm the fixed version and whether authentication is required for the OpenEventEvidenceFile.do endpoint, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115740.","how_to_check":"- Check the installed DLP on-prem extensions version against `11.13.1`\n- Review whether the `OpenEventEvidenceFile.do` endpoint is reachable from untrusted networks\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["product-not-deployed"],"who_is_affected":"Organizations running the DLP on-prem extensions at version 11.13.1 or earlier are exposed, where the OpenEventEvidenceFile.do endpoint accepts requests. Systems that do not run this product or whose endpoint is not reachable by attackers can skip it. The sources do not say which fixed version resolves the issue.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000744,"input_tokens":4265,"output_tokens":635,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115740':18A,21A '-2026':17A,20A '11.13.1':29B,91C 'accept':39B,103C 'allow':94C 'arbitrari':40B,104C 'attack':59B,70B,134C 'attacker-control':69B,133C 'attacker-suppli':58B 'attempt':114C 'authent':66B,130C 'caus':121C 'code':113C 'control':71B,135C 'credenti':15A,76B 'cve':16A,19A 'dlp':1A,22B,34B,85C 'earlier':31B,93C 'endpoint':51B,102C 'exist':82C 'expos':75B 'extens':5A,38B,89C 'file':9A,45B,96C,119C 'forgeri':80C 'host':72B,136C 'hostnam':126C 'initi':64B,128C 'leak':13A 'let':11A 'on-prem':2A,23B,35B,86C 'open':56B,116C 'openeventevidencefile.do':50B,101C 'paramet':47B,98C 'path':10A,42B,61B,106C,120C 'prefix':46B,97C 'prem':4A,25B,37B,88C 'request':79C 'resolv':124C 'server':12A,55B,77C,111C 'server-sid':110C 'side':78C,112C 'smb':14A,65B,129C 'specifi':118C 'ssrf':6A 'suppli':60B 'unc':8A,41B,105C 'valid':53B,108C 'version':28B,90C 'via':7A 'vulner':81C 'window':27B,63B,122C 'without':52B,107C","nicknames":[],"mitigations":[],"who_affected":"Organizations running the DLP on-prem extensions at version 11.13.1 or earlier are exposed, where the OpenEventEvidenceFile.do endpoint accepts requests. Systems that do not run this product or whose endpoint is not reachable by attackers can skip it. The sources do not say which fixed version resolves the issue.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dlp","medium","onprem","other","windows"],"campaign_type":null,"first_public_at":"2026-11-05T16:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"trellixpsirt@trellix.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115740","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115740","severity":null,"published_at":"2026-11-05T16:17:34+00:00","modified_at":"2026-11-05T16:17:34+00:00","first_seen_at":"2026-11-05T16:40:01+00:00","fetched_at":"2026-11-05T16:40:01+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}