Is CVE-2026-79760 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79760 being exploited in the wild.

How severe is CVE-2026-79760?

Medium severity, with a CVSS score of 6.4, published 24 September 2026.

Which products and versions are affected?

Termix-SSH Termix 2.5.0 before 2.5.1.

Is there a fix for CVE-2026-79760?

A patch was published on 2026-07-19: version 2.5.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79760 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-79760?

Check whether you run Termix-SSH Termix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79760: Termix server-side request forgery in notification test

CVE-2026-79760 · Severity: medium · CVSS 6.4 · Published 2026-09-24

Termix is a web-based platform for managing servers via SSH terminal and file editing. Authenticated users can trick it into sending HTTP requests to internal systems by configuring webhook notifications with malicious URLs, potentially accessing or modifying internal services that the Termix server can reach. This bypasses network isolation and allows attackers to attack internal infrastructure from within the application.

Technologies: Termix-SSH Termix. Vendors: Termix-SSH.

Quick answers

Is CVE-2026-79760 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79760 being exploited in the wild.
How severe is CVE-2026-79760?: Medium severity, with a CVSS score of 6.4, published 24 September 2026.
Which products and versions are affected?: Termix-SSH Termix 2.5.0 before 2.5.1.
Is there a fix for CVE-2026-79760?: A patch was published on 2026-07-19: version 2.5.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79760 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-79760?: Check whether you run Termix-SSH Termix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a server-side request forgery (SSRF) in the notification-channel test endpoint (alert-rules-routes.ts → notification-sender.ts) that lacks destination allowlisting or private-address filtering. Authenticated users can configure webhook/ntfy channels with arbitrary URLs and trigger requests via the test endpoint; webhook mode also permits attacker-controlled HTTP methods and headers. While response bodies are not returned, an attacker can probe internal services and potentially trigger state changes on services that accept the fixed notification body.

Affected products

Termix-SSH Termix 2.5.0 before 2.5.1

Timeline

2026-09-24: disclosed
2026-07-19: patched: version 2.5.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.