Preliminary research

When Audits Fail Part 2: From Pre-Auth SSRF to RCE in TRUfusion Enterprise

AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Chains TRUfusion Enterprise's absolute-URL proxy behavior into SSRF against an internal Axis2 service, then combines a default credential and path traversal to upload a web shell. The result is another unauthenticated route to remote code execution across affected deployments.

Record

Published by

RCE Security GmbH - Your European Partner for Offensive Security

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• ssrf
• proxy
• default-credentials
• path-traversal
• file-upload
• attack-chain
• rce
• owasp-a01-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of RCE Security GmbH - Your European Partner for Offensive Security, first published at the original source. Preserved copies are kept so the citation survives its host.