Is CVE-2026-77164 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77164 being exploited in the wild.

How severe is CVE-2026-77164?

Medium severity, with a CVSS score of 6.2, published 18 September 2026.

Is there a fix for CVE-2026-77164?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-77164 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-77164?

Check whether you run Nextcloud Circles at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77164: Nextcloud Circles remote-instance signature verification SSRF

CVE-2026-77164 · Severity: medium · CVSS 6.2 · Published 2026-09-18

Nextcloud Circles is a collaboration feature that allows users to organize into groups. An unauthenticated attacker can force the server to make requests to internal addresses by crafting malicious requests to the public event endpoints, bypassing the server's normal protections against such requests. While the attacker cannot read sensitive data returned by these internal services, they can probe which internal services are running and reachable.

Vendors: Nextcloud.

Quick answers

Is CVE-2026-77164 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77164 being exploited in the wild.
How severe is CVE-2026-77164?: Medium severity, with a CVSS score of 6.2, published 18 September 2026.
Which products and versions are affected?: Nextcloud Circles <UNKNOWN>.
Is there a fix for CVE-2026-77164?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-77164 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-77164?: Check whether you run Nextcloud Circles at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a blind server-side request forgery (SSRF) vulnerability in Nextcloud Circles' remote-instance signature verification logic. The vulnerability occurs because the code fetches an attacker-supplied keyId URL before validating trust in the remote instance, and explicitly bypasses Nextcloud's core SSRF protections to allow requests to private and local addresses. The public, unauthenticated endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/ are reachable without authentication and trigger this code path. An unauthenticated attacker can exploit this to force the server to issue GET requests to internal addresses; however, the response body is never returned to the requester, limiting impact to service discovery and reachability probing.

Affected products

Nextcloud Circles <UNKNOWN>

Timeline

2026-09-18: disclosed

References

https://hackerone.com/reports/3303283

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.