Over 400 IPs Exploiting Multiple SSRF Vulnerabilities in Coordinated Cyber Attack

DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.

CVE-2020-7796 is a server-side request forgery (SSRF, CWE-918) in Synacor Zimbra Collaboration Suite (ZCS) versions before 8.8.15 Patch 7, rated critical at CVSS 9.8 with network reachability and no authentication or privileges required. The flaw is triggered when the WebEx zimlet is installed and zimlet JSP processing is enabled, allowing an unauthenticated remote attacker to make the Zimbra server issue attacker-controlled requests. Successful SSRF can let the attacker reach internal network services from the mail server's position (e.g., internal admin interfaces or other hosts behind the firewall), potentially leading to information disclosure or further compromise, and the CVSS vector indicates high impact to confidentiality, integrity, and availability. Any organization running a vulnerable Zimbra version with the WebEx zimlet present is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-17, confirming active exploitation, and it carries a very high EPSS score (84.4%, top percentile) amid a reported coordinated surge in SSRF exploitation activity.

Do: Upgrade Zimbra Collaboration Suite to 8.8.15 Patch 7 or later. If patching must be delayed, remove or disable the WebEx zimlet and disable zimlet JSP processing to eliminate the trigger; first check whether the WebEx zimlet is installed, since instances without it are not exposed to this specific flaw. As a KEV entry, federal agencies must apply vendor mitigations per BOD 22-01 (or discontinue use if unavailable), and all operators should review Zimbra logs for unauthenticated requests reaching zimlet JSP endpoints.

CVE-2021-21973 is a server-side request forgery (SSRF, CWE-918) in the vSphere Client (HTML5), caused by improper validation of URLs in a vCenter Server plugin. An unauthenticated attacker with network access to TCP port 443 can trigger it by sending a crafted POST request to the affected vCenter Server plugin, causing vCenter to make attacker-influenced internal requests. The direct impact is information disclosure (confidentiality only, CVSS 3.1 base 5.3), but SSRF in vCenter is frequently chained with other vCenter flaws to reach remote code execution, as reflected in the related advisories. Everyone running VMware vCenter Server 7.x/6.7/6.5 or VMware Cloud Foundation 4.x/3.x before the fixed releases is affected. The flaw is actively exploited: it is listed in CISA KEV (added 2022-03-07) and carries a very high EPSS (87.6%), with reporting of coordinated SSRF exploitation campaigns involving hundreds of source IPs.

Do: Upgrade vCenter Server to 7.0 U1c, 6.7 U3l, or 6.5 U3n, and Cloud Foundation to 4.2 or 3.10.1.2, per VMware's instructions. Until patched, restrict access to vCenter's port 443 from untrusted networks and review access logs for suspicious unauthenticated POST requests to the vSphere Client plugin endpoints. Given the KEV listing and reports of coordinated SSRF exploitation, treat patching as urgent even though this flaw alone yields information disclosure.

VMware (now Omnissa) Workspace ONE UEM console, in the 20.0.8, 20.11.0, 21.2.0 and 21.5.0 release lines before their fixed builds, contains a server-side request forgery flaw (CWE-918). A malicious actor with network access to the UEM console can trigger it by sending crafted, unauthenticated requests, causing the console to issue requests on the attacker's behalf. Successful exploitation can give the attacker access to sensitive information reachable from the console (high confidentiality impact, with no integrity or availability impact per the CVSS score). Organizations running an affected Workspace ONE UEM console deployment are exposed, with risk concentrated on consoles reachable from untrusted networks. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-03-09, EPSS assigns a 97.4% probability of exploitation within 30 days (100th percentile), and reporting describes a coordinated SSRF exploitation surge involving 400+ source IPs.

Do: Upgrade the Workspace ONE UEM console to the fixed builds — 20.0.8.37, 20.11.0.40, 21.2.0.27, or 21.5.0.37 (or later). Until patched, restrict network access to the console (management networks/VPN only, no direct internet exposure) and review logs for unauthenticated or anomalous outbound requests from the console, especially given the reported coordinated SSRF exploitation wave from 400+ IPs. Organizations subject to federal BOD 22-01 must apply vendor mitigations or the prescribed cloud-service guidance.

CVE-2021-22175 is a server-side request forgery (SSRF, CWE-918) in GitLab's webhook handling that affects all GitLab versions starting from 10.5. It is exploitable when the administrator setting that allows webhook and integration requests to the internal network is enabled, and an unauthenticated attacker can leverage it even on instances where self-registration is disabled, so no account or credentials are required. A successful attack makes the GitLab server issue requests to internal-network destinations, letting the attacker probe or interact with internal-only services reachable from the GitLab host (for example cloud metadata endpoints or internal APIs); the flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact. Self-managed GitLab deployments running an affected version with internal-network outbound requests enabled are the exposed population, while instances that are not internet-reachable or that keep that setting disabled are not reachable by this unauthenticated attack path. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-02-18, confirming in-the-wild exploitation; EPSS assigns a 53.4% probability of exploitation within 30 days (99th percentile), and related reporting describes coordinated SSRF exploitation involving more than 400 source IPs.

Do: Upgrade self-managed GitLab to a current supported release; the fix shipped in GitLab 13.7.1 (with backports in 13.6.2 and 13.5.4), so any modern release already includes it, and federal agencies must meet BOD 22-01 timelines or discontinue use of unpatched versions. If patching must wait, check whether Admin Area → Settings → Network allows outbound requests to the internal network for web hooks and integrations, and disable that option or restrict the GitLab host's egress to internal ranges as an interim mitigation. Review webhook and GitLab host network logs for unexpected requests to internal services or cloud metadata endpoints (e.g., 169.254.169.254) that would indicate SSRF probing.

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited

CVE-2021-39935 is a server-side request forgery (CWE-918) in GitLab Community Edition and Enterprise Edition that allows unauthorized external users to make the GitLab server issue requests through the CI Lint API. By abusing the server's network position, an attacker can reach internal-only resources such as loopback or private-network services, potentially mapping or accessing internal infrastructure without credentials. All deployments of the affected editions are potentially exposed, with actual risk depending on whether the CI Lint API is reachable by unauthenticated external users. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-02-03, indicating known exploitation in the wild, though no public proof-of-concept is known and ransomware use is unconfirmed. EPSS estimates a 35.6% probability of exploitation within 30 days (98th percentile).

Do: Upgrade GitLab CE/EE to the patched release identified in GitLab's security advisory for CVE-2021-39935 (version numbers are not provided in the source data). Until patching is complete, restrict unauthenticated external access to the CI Lint API (e.g., at the reverse proxy or firewall) and review logs for unexpected requests to loopback or internal-network targets originating from CI lint calls. Federal agencies must follow BOD 22-01 remediation timelines following the 2026-02-03 KEV listing; discontinue or isolate use if mitigations are unavailable.

A vulnerability classified as critical has been found in ColumbiaSoft Document Locator. This affects an unknown part of the file /api/authentication/login of the component WebTools. The manipulation of the argument Server leads to improper authentication. It is possible to initiate the attack remotely. Upgrading to version 7.2 SP4 and 2021.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-243729 was assigned to this vulnerability.

CVE-2024-21893 is a server-side request forgery (SSRF) vulnerability in the SAML component of Ivanti Connect Secure (formerly Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons. A remote attacker can trigger the flaw with crafted unauthenticated requests to the SAML component, causing the appliance to make requests to otherwise restricted resources. Successful exploitation allows the attacker to access certain restricted resources without any credentials, and CISA notes the flaw has been used in ransomware operations. Any organization running an affected Ivanti Connect Secure, Policy Secure, or Neurons deployment is exposed, particularly where the appliance is reachable from the internet. The vulnerability is confirmed exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2024-01-31, carries an EPSS probability of 100%, and no public proof-of-concept is known.

Do: Apply Ivanti's released patches or the vendor-issued mitigations immediately per vendor instructions, or discontinue use of the product if mitigations are unavailable, as required by CISA. Because ransomware use is documented, review SAML-related logs and appliance audit trails for signs of exploitation and follow-on compromise, and check for indicators of post-exploitation activity. Monitor Ivanti advisories for patched version numbers and updated mitigation guidance, since specific fixed versions are not yet specified in the available data.

CVE-2024-6587 is a server-side request forgery (SSRF, CWE-918) flaw in the BerriAI LiteLLM LLM proxy, reported for version 1.38.10. It is triggered when a client supplies an attacker-controlled `api_base` parameter in a request to POST /chat/completions, causing LiteLLM to send that request — including the configured OpenAI API key — to the attacker-chosen domain. An attacker who points `api_base` at a server they control can intercept the OpenAI API key and then access or misuse it directly against the OpenAI API, giving a high-confidentiality impact per the 7.5 CVSS score (no integrity or availability impact). Any deployment of LiteLLM that allows callers, without authentication per the CVSS vector (PR:N), to set `api_base` on this endpoint is affected, with internet-exposed proxy instances at greatest risk. No confirmed in-the-wild exploitation of this specific CVE is documented yet, but a public proof-of-concept exists, EPSS assigns a ~35% (98th-percentile) probability of exploitation within 30 days, and defenders are reporting a broader coordinated surge in SSRF exploitation.

Do: Upgrade LiteLLM to the latest patched release and stop trusting client-supplied `api_base` values — validate or allow-list them, or disable user-controlled `api_base` on /chat/completions. Review proxy logs for completions requests sent to unexpected external domains and rotate any OpenAI API keys configured in LiteLLM, since a leaked key gives attackers direct access to your OpenAI account and billing.