CVE-2026-92931

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package…

Risk score: 61/100
CVSS: 8.8 v3.1
Exploit chance (30 days): 0.3%
Published: 5 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Amber

CVSS 8.8 high
Remotely exploitable without logging in

References

https://community.progress.com/s/article/Sitefinity-Critical-Security-Advisory-for-Addressing-Security-Vulnerabilities-in-Next-js-September-2026

Original description

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.

Last activity 5 Oct 2026. Patch Forecast updates every hour.