InfoSecBulletin Cybersecurity for mankind
GreyNoise warns of a coordinated increase in the exploitation of Server-Side Request Forgery (SSRF) vulnerabilities across various platforms.
“At least 400 IPs have been seen actively exploiting multiple SSRF CVEs simultaneously, with notable overlap between attack attempts,” the company said, adding it observed the activity on March 9, 2025.
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Countries targeted by SSRF exploitation attempts include the United States, Germany, Singapore, India, Lithuania, Japan, and notably Israel, which experienced a surge on March 11, 2025.
The list of SSRF vulnerabilities being exploited are listed below:
CVE-2017-0929 (CVSS score: 7.5) – DotNetNuke
CVE-2020-7796 (CVSS score: 9.8) – Zimbra Collaboration Suite
CVE-2021-21973 (CVSS score: 5.3) – VMware vCenter
CVE-2021-22054 (CVSS score: 7.5) – VMware Workspace ONE UEM
CVE-2021-22175 (CVSS score: 9.8) – GitLab CE/EE
CVE-2021-22214 (CVSS score: 8.6) – GitLab CE/EE
CVE-2021-39935 (CVSS score: 7.5) – GitLab CE/EE
CVE-2023-5830 (CVSS score: 9.8) – ColumbiaSoft DocumentLocator
CVE-2024-6587 (CVSS score: 7.5) – BerriAI LiteLLM
CVE-2024-21893 (CVSS score: 8.2) – Ivanti Connect Secure
OpenBMCS 2.4 Authenticated SSRF Attempt (No CVE)
Zimbra Collaboration Suite SSRF Attempt (No CVE)
Many of the same IP addresses are targeting multiple SSRF vulnerabilities simultaneously, indicating organized exploitation or automated attacks.
Users should apply the latest patches, restrict outbound connections to only what’s necessary, and watch for any suspicious outbound requests due to ongoing exploitation attempts.
“Many modern cloud services rely on internal metadata APIs, which SSRF can access if exploited,” GreyNoise said. “SSRF can be used to map internal networks, locate vulnerable services, and steal cloud credentials.”
