Is CVE-2026-33534 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-33534, but active exploitation has not been confirmed.

Can CVE-2026-33534 be exploited remotely?

Yes. CVE-2026-33534 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33534?

CVE-2026-33534 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-33534

MEDIUMPOC

CVE-2026-33534

CWE-918Published: April 13, 2026· Updated: Apr 17, 2026

4.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:6.9th

Official Description

EspoCRM is an open source customer relationship management application. Versions 9.3.3 and below have an authenticated Server-Side Request Forgery (SSRF) vulnerability that allows bypassing the internal-host validation logic by using alternative IPv4 representations such as octal notation (e.g., 0177.0.0.1 instead of 127.0.0.1). This is caused by HostCheck::isNotInternalHost() function relying on PHP's filter_var(..., FILTER_VALIDATE_IP), which does not recognize alternative IP formats, causing the validation to fall through to a DNS lookup that returns no records and incorrectly treats the host as safe, however the cURL subsequently normalizes the address and connects to the loopback destination. Through the confirmed /api/v1/Attachment/fromImageUrl endpoint, an authenticated user can force the server to make requests to loopback-only services and store the fetched response as an attachment. This vulnerability is distinct from CVE-2023-46736 (which involved redirect-based SSRF) and may allow access to internal resources reachable from the application runtime. This issue has been fixed in version 9.3.4.

NVD Source

Technical Analysis

CVE-2026-33534 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A proof-of-concept (PoC) exploit exists for CVE-2026-33534. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.