This vulnerability (CVE-2026-65516) is an unauthenticated SSRF issue in PeproDev Ultimate Invoice software versions up to 2.2.6. SSRF vulnerabilities enable attackers to make the affected server perform HTTP requests to arbitrary domains or internal systems. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts to confidentiality and integrity with no impact on availability. The vendor has not yet provided an official fix or remediation level, and no patch links are available. The product is not a cloud service, so remediation depends on vendor patch releases.

Successful exploitation could allow an unauthenticated attacker to cause the server to send crafted requests to internal or external resources, potentially leading to partial confidentiality and integrity compromise of data accessible via those requests. There is no indication of availability impact. The vulnerability is rated high severity based on CVSS 3.1 score 7.2.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access from the affected server to sensitive internal resources to reduce SSRF impact. Monitor vendor communications for updates on patches or mitigations.