CVE-2026-92931: Progress Sitefinity SSRF

CVE-2026-92931 is a server-side request forgery, CWE-918, in @progress/sitefinity-nextjs-sdk, the npm package Progress Software ships for building Next.js front ends on Sitefinity. Versions 15.1.8326 through 15.4.8637 are affected and 15.4.8638 is the first release outside the range. The vendor description says a remote attacker may make server-side requests to an attacker-controlled host, potentially exposing sensitive information. The CVSS:3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H with base score 8.8, rated high in NVD while the offseq feed headline and EUVD-2026-92430 label it critical. No exploitation is documented: the CVE is absent from KEV, EPSS reads 0.0, and no researcher write-up or proof of concept has surfaced.

The placement matters more than the score. This SDK runs inside the Node.js tier that renders Sitefinity content, usually a containerized or edge-deployed front end, so a working SSRF hands an attacker a request fired from inside that network, with internal APIs and the cloud metadata service as the standard pivot targets. The dates tell the sharper story: npm published 15.4.8638 on 2026-09-21 and the vendor advisory in the NVD references carries September 2026 in its title, while the CVE record itself only went public on 2026-10-05. The patched code has therefore been public and diffable on npm for two weeks before most defenders had a CVE to search for, and the last affected version, 15.4.8637, shipped on 2026-08-26, so the vulnerable code is recent and has spread through lockfiles into renderer deployments. The UI:R term in the vector is the main comfort: exploitation requires a user interaction step, which keeps this above fire-and-forget SSRF.

Inventory first: search package-lock.json for @progress/sitefinity-nextjs-sdk and flag any resolved version from 15.1.8326 to 15.4.8637. Upgrade to 15.4.8638 or later, with 15.4.8639 published on 2026-09-29 as the current line, then rebuild the renderer image and confirm the running bundle with npm ls @progress/sitefinity-nextjs-sdk, since only a rebuilt and redeployed image carries the fix to production. Egress controls on the renderer host cut the blast radius: deny RFC1918 destinations and the metadata address 169.254.169.254, and allowlist only the Sitefinity CMS host the SDK needs. For hunting, pull reverse proxy logs in front of the renderer and look for requests whose parameters carry absolute URLs or unfamiliar hostnames, then review outbound connection logs from renderer containers for destinations other than the Sitefinity backend.

Two developments would move the assessment. A KEV listing or an EPSS climb off 0.0 would turn routine patching into an emergency, and any public proof of concept or scanner telemetry against Sitefinity Next.js renderer endpoints would confirm the two-week diff window has been used. Progress updating the community advisory past its September 2026 state would signal the vendor sees more in this bug than the current description admits.