PT-2026-20237 · Rocket · Rocket Trufusion Enterprise

CVE-2025-32355 · Published 2026-02-17 · Updated 2026-03-23

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Rocket TRUfusion Enterprise versions through 7.10.4.0

Description The Rocket TRUfusion Enterprise reverse proxy is misconfigured, permitting the specification of absolute URLs within HTTP request lines. This configuration flaw allows the proxy to load resources from the provided URL.

Recommendations Update Rocket TRUfusion Enterprise to a version later than 7.10.4.0.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-32355

Affected Products

Rocket Trufusion Enterprise

References · 15

• 🔥 https://rcesecurity.com/advisories/cve-2025-32355 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-32355 · Security Note
• https://rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise · Note
• https://twitter.com/ksg93rd/status/2023791920942608810 · Twitter Post
• https://rcesecurity.com · Note
• https://reddit.com/r/CVEWatch/comments/1r9sfwr/top_10_trending_cves_20022026 · Reddit Post
• https://twitter.com/MrTuxracer/status/2023793156068647265 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2023984974848778583 · Twitter Post
• https://twitter.com/CVEnew/status/2036024271731130742 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1r8wba2/top_10_trending_cves_19022026 · Reddit Post
• https://twitter.com/infoflowcloud/status/2036025538179981460 · Twitter Post
• https://twitter.com/rcesecurity/status/2023658654604431544 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1r80265/top_10_trending_cves_18022026 · Reddit Post
• https://twitter.com/pdnuclei_bot/status/2024167062562885935 · Twitter Post
• https://t.me/cveNotify/155117 · Telegram Post