CVE-2026-9557 is a medium severity SSRF vulnerability (CWE-918) in Mautic's Focus component. Authenticated users can supply URLs that are insufficiently validated, causing the server to perform outbound HTTP requests to arbitrary destinations. This behavior can be exploited to conduct internal network reconnaissance or to interact with internal or external systems that the server can reach. The vulnerability affects Mautic versions 4.0.0, 5.0.0, 6.0.0, and 7.0.0. There is no vendor advisory or patch information available at this time, and no known exploits have been observed.

An authenticated user can leverage this SSRF vulnerability to make the Mautic server send HTTP requests to arbitrary locations. This may allow attackers to map internal network topology or access internal services not otherwise reachable externally. The confidentiality and integrity of internal network resources could be impacted, but there is no indication of direct denial of service or remote code execution from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user privileges to trusted users only and monitor for unusual outbound requests from the server. Avoid exposing sensitive internal services that could be targeted via SSRF.