PT-2026-20237 · Rocket · Rocket Trufusion Enterprise

Published 2026-02-17 · Updated 2026-03-23 · CVE-2025-32355

Positive Technologies · (AI Summary)

CVSS v3.1

7.3

High

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Rocket TRUfusion Enterprise versions through 7.10.4.0

Description The Rocket TRUfusion Enterprise reverse proxy is misconfigured, permitting the specification of absolute URLs within HTTP request lines. This configuration flaw allows the proxy to load resources from the provided URL.

Recommendations Update Rocket TRUfusion Enterprise to a version later than 7.10.4.0.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-32355

Affected Products

Rocket Trufusion Enterprise

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-32355 · Security Note
• https://reddit.com/r/CVEWatch/comments/1r9sfwr/top_10_trending_cves_20022026 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1r8wba2/top_10_trending_cves_19022026 · Reddit Post
• https://rcesecurity.com/advisories/cve-2025-32355 · Note
• https://reddit.com/r/CVEWatch/comments/1r80265/top_10_trending_cves_18022026 · Reddit Post
• https://twitter.com/rcesecurity/status/2023658654604431544 · Twitter Post
• https://twitter.com/MrTuxracer/status/2023793156068647265 · Twitter Post
• https://twitter.com/ksg93rd/status/2023791920942608810 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2023984974848778583 · Twitter Post
• https://twitter.com/CVEnew/status/2036024271731130742 · Twitter Post
• https://twitter.com/infoflowcloud/status/2036025538179981460 · Twitter Post
• https://rocketsoftware.com/products/rocket-b2b-supply-chain-integration/rocket-trufusion-enterprise · Note
• https://rcesecurity.com · Note
• https://twitter.com/pdnuclei_bot/status/2024167062562885935 · Twitter Post
• https://t.me/cveNotify/155117 · Telegram Post