CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
Affected products
redhat: enterprise linux desktop; redhat: enterprise linux eus; redhat: enterprise linux for ibm z systems; redhat: enterprise linux for ibm z systems eus; redhat: enterprise linux for power big endian; redhat: enterprise linux for power big endian eus; redhat: enterprise linux for power little endian; redhat: enterprise linux for power little endian eus; redhat: enterprise linux hpc node; redhat: enterprise linux hpc node eus; redhat: enterprise linux server; redhat: enterprise linux server aus; redhat: enterprise linux server from rhui; redhat: enterprise linux server supplementary eus; redhat: enterprise linux server tus
References10
- git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd… PatchVendor Advisory
- www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 Vendor Advisory
- git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd… PatchVendor Advisory
- www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=29588 Vendor Advisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.… Third Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.… Third Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.… Third Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.… Third Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.… Third Party Advisory
- rhn.redhat.com/errata/RHSA-2016-0726.html Third Party Advisory
Metrics
- CVSS 3.1
-
5.5
MEDIUM
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - EPSS — exploit probability
- 76% percentile: 100 · as of 8 November 2026
- CWE
- CWE-918
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.