Server Side Request Forgery in DLP On-Prem Extensions by Trellix
CVE-2026-115740

5.3MEDIUM

Key Information:

Vendor

Trellix

Status
Dlp On-prem Extensions
Vendor
CVE Published:
5 November 2026

What is CVE-2026-115740?

A server-side request forgery (SSRF) vulnerability exists in Trellix DLP On-Prem Extensions versions 11.13.1 and earlier. This flaw allows attackers to exploit the file Prefix parameter in the OpenEventEvidenceFile.do endpoint, enabling the acceptance of arbitrary UNC paths without proper validation. As a result, the server-side code attempts to access malicious file paths, causing the Windows operating system to resolve the hostname and potentially initiate SMB authentication with an attacker-controlled host. This poses significant security risks, as it could lead to unauthorized information exposure and system compromise.

Affected Version(s)

DLP on-prem extensions 11.13.1 and earlier

References

https://support.trellix.com/s/article/000015949

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.