PT-2026-36079 · 4D · 4D Server

Marcelo Reyes · Published 2026-04-30 · Updated 2026-05-29 · CVE-2024-39847

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y

Name of the Vulnerable Software and Affected Versions 4D server (affected versions not specified)

Description Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints. This allows for read access to files on the application server and adjacent network shares, as well as the ability to perform HTTP GET requests to arbitrary services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-39847

Affected Products

4D Server

References · 9

• 🔥 https://schutzwerk.com/en/blog/schutzwerk-sa-2024-002 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-39847 · Security Note
• https://twitter.com/DFIR_Lab/status/2060160534066995607 · Twitter Post
• https://t.me/cveNotify/162120 · Telegram Post
• http://seclists.org/fulldisclosure/2026/May/0 · Note
• https://twitter.com/VulmonFeeds/status/2049785333722566795 · Twitter Post
• https://t.me/cveNotify/161510 · Telegram Post
• https://4d.com · Note
• https://t.me/cveNotify/163796 · Telegram Post