Weakness / #20
CWE-918: Server-side request forgery in CISA KEV
Server-Side Request Forgery (SSRF)
Answer 22 KEV entries list CWE-918 (Server-side request forgery) as of catalog 2026.09.23, 1.3% of the catalog and rank 20 of 185 weaknesses. The most affected vendor is Microsoft (4).
An attacker makes the server send requests to destinations of the attacker's choosing, often internal systems.
- KEV entries
- 221.3% of catalog
- Vendors
- 14affected
- Ransomware: known
- 1045.5%
- First added
- 2021-11-03
- Latest added
- 2026-09-02
VVendors
TAdditions by year
| Year | Added |
|---|---|
| 2021 | 5 |
| 2022 | 3 |
| 2023 | 1 |
| 2024 | 1 |
| 2025 | 3 |
| 2026 | 9 |
PProducts
| Product | Entries | Share |
|---|---|---|
| Microsoft Exchange Server | 3 | 13.6% |
| SonicWall SMA1000 Appliances | 2 | 9.1% |
| Kestra Kestra OSS | 1 | 4.5% |
| MLflow MLflow | 1 | 4.5% |
| Cisco Unified Communications Manager | 1 | 4.5% |
| Omnissa Workspace One UEM | 1 | 4.5% |
| GitLab GitLab | 1 | 4.5% |
| Synacor Zimbra Collaboration Suite | 1 | 4.5% |
EAll entries
Cite this
22 CISA KEV entries list CWE-918 (Server-side request forgery), 1.3% of the catalog. Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/cwe/cwe-918/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23.