Is CVE-2025-26515 actively exploited?

No active exploitation of CVE-2025-26515 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-26515 be exploited remotely?

Yes. CVE-2025-26515 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-26515?

CVE-2025-26515 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2025-26515

HIGH

CVE-2025-26515

CWE-918Published: September 19, 2025· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

StorageGRID (formerly

StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 without

Single Sign-on enabled are susceptible to a Server-Side Request Forgery

(SSRF) vulnerability. Successful exploit could allow an unauthenticated

attacker to change the password of any Grid Manager or Tenant Manager

non-federated user.

NVD Source

Technical Analysis

CVE-2025-26515 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.5.