PT-2026-22237 · Psi Probe · Psi Probe

Ana10Gy + 1 · Published 2026-02-26 · Updated 2026-03-03 · CVE-2026-3270

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PSI Probe versions up to 5.3.0

Description A flaw exists in PSI Probe that allows for server-side request forgery. This issue stems from the lookup function within the Whois.java file, located in the psi-probe-core/src/main/java/psiprobe/tools component. The manipulation of this function can lead to unauthorized requests being made on the server. The attack can be initiated remotely. The exploit for this issue has been publicly disclosed. The vendor was notified but did not provide a response.

Recommendations Versions prior to 5.3.0 should be used.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-3270

GHSA-429M-9874-RX9W

Affected Products

Psi Probe

References · 11

• 🔥 https://github.com/AnalogyC0de/public_exp/issues/12 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-3270 · Security Note
• https://osv.dev/vulnerability/GHSA-429m-9874-rx9w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3270 · Vendor Advisory
• https://github.com/psi-probe/psi-probe · Note
• https://t.me/cveNotify/154025 · Telegram Post
• https://vuldb.com/?submit.758666 · Note
• https://t.me/CVEtracker/45891 · Telegram Post
• https://vuldb.com/?ctiid.347994 · Note
• https://vuldb.com/?id.347994 · Note
• https://twitter.com/CVEnew/status/2027466620285964652 · Twitter Post