High severity · published Apr 30, 2026
CVE-2024-39847
Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
4S
4D Server · 4D
through v20 R3 · source: vendor
SE
Server · 4d
20; 20; 20 · source: NVD