CVE-2026-115740 in DLP on-prem extensionsinfo

Summary

by MITRE • 11/05/2026

Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix parameter in the OpenEventEvidenceFile.do endpoint accepts arbitrary UNC paths without validation. The server-side code attempts to open the specified file path, causing Windows to resolve the hostname and initiate SMB authentication to the attacker-controlled host.

Once again VulDB remains the best source for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsible

Trellix

Reservation

10/23/2026

Disclosure

11/05/2026

Moderation

accepted

EPSS

0.00000

KEV

no

Activities

very low

Sector

Chemical, Finance, ...

Sources

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-115740
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-115740
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-115740/

◂ PreviousOverviewNext ▸

Want to know what is going to be exploited?

We predict KEV entries!