CVE-2026-115740

Quick assessment

Affected

Trellix DLP on-prem extensions

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在版本 11.13.1 及更早版本的 DLP 本地扩展（on-prem extensions）中存在服务端请求伪造（SSRF）漏洞。该漏洞使得端点中的文件前缀（Prefix）参数能够接受未经验证的任意 UNC 路径。服务器端代码会尝试打开指定的文件路径，从而导致 Windows 解析主机名并向攻击者控制的服务器发起 SMB 身份验证。

CVSS 5.3 · Medium Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1071.001 · Web Protocols T1569.002 · Service Execution

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix parameter in the OpenEventEvidenceFile.do endpoint accepts arbitrary UNC paths without validation. The server-side code attempts to open the specified file path, causing Windows to resolve the hostname and initiate SMB authentication to the attacker-controlled host.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Trellix	DLP on-prem extensions	11.13.1 and earlier	-

II. Public POCs for CVE-2026-115740

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115740

请登录查看更多情报信息。

Other References for CVE-2026-115740 (1)

https://support.trellix.com/s/article/000015949

https://www.cve.org/CVERecord?id=CVE-2026-115740

Same Patch Batch · Trellix · 2026-11-05 · 3 CVEs total

CVE-2026-115738	7.1 HIGH	DLP on-prem 11.13.1 及更早版本 SQL 注入漏洞
CVE-2026-115739	6.0 MEDIUM	DLP on-prem 11.13.1 硬编码密钥漏洞

IV. Related Vulnerabilities

Same product: DLP on-prem extensions

Same vendor: Trellix

Same weakness: CWE-918