PT-2026-44801 · Mautic · Mautic

John Linhart + 2 · CVE-2026-9557 · Published 2026-05-29 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mautic (affected versions not specified)

Description A Server-Side Request Forgery (SSRF) exists in the Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server. This allows for internal network reconnaissance or forcing requests to arbitrary internal or external destinations. SSRF is a flaw where an attacker can abuse server functionality to read or update internal resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-9557

GHSA-JMV8-8J9J-RCPC

Affected Products

Mautic

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9557.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-9557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9557 · Security Note
• https://osv.dev/vulnerability/GHSA-jmv8-8j9j-rcpc · Vendor Advisory
• https://github.com/mautic/mautic · Note
• https://github.com/mautic/mautic/security/advisories/GHSA-jmv8-8j9j-rcpc · Note
• https://twitter.com/VulmonFeeds/status/2060338268378476902 · Twitter Post
• https://packagist.org · Note
• https://t.me/cveNotify/165169 · Telegram Post
• https://t.me/cveNotify/208744 · Telegram Post