CVE-2025-32355
HIGH EXPLOITED NUCLEIRocket TRUfusion Enterprise <7.10.4.0 - SSRF
Title source: llmExploitation Summary
CVE-2025-32355 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.
Description
Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. However, the proxy is misconfigured in a way that allows specifying absolute URLs in the HTTP request line, causing the proxy to load the given resource.
Nuclei Templates (1)
Rocket TRUfusion Enterprise - Server Side Request Forgery
HIGHVERIFIEDby princechaddha,rcesecurity,DhiyaneshDk
Shodan:
html:"TRUfusion Enterprise"
References (3)
Core 3
Core References
Various Sources
https://www.rcesecurity.com
Various Sources
https://www.rcesecurity.com/advisories/cve-2025-32355/
Scores
CVSS v3
7.3
EPSS
0.0199
EPSS Percentile
84.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
VulnCheck KEV
2026-03-31
CWE
CWE-918
Status
published
Products (1)
rocketsoftware/trufusion_enterprise
< 7.10.5.0
Published
Feb 17, 2026
Tracked Since
Feb 18, 2026