CVE-2026-2252
Last modified
CVE-2026-2252 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Xerox | Freeflow Core | < 8.1.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-2252?
How severe is CVE-2026-2252?
How do I fix CVE-2026-2252?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-22514Improper Control of Filename for Include/Require Statement i…8.1
- CVE-2026-22515Improper Control of Filename for Include/Require Statement i…8.1
- CVE-2026-22516Improper Control of Filename for Include/Require Statement i…8.1
- CVE-2026-22517Missing Authorization vulnerability in Passionate Brains GA4…5.4
- CVE-2026-22518Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2026-22519Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2026-22520Improper Neutralization of Input During Web Page Generation …7.1
- CVE-2026-22521Improper Control of Filename for Include/Require Statement i…7.5
- CVE-2026-22522Missing Authorization vulnerability in Munir Kamal Block Sli…6.5
- CVE-2026-22523Improper Neutralization of Input During Web Page Generation …7.1
- CVE-2026-22524Improper Neutralization of Input During Web Page Generation …7.1
- CVE-2026-2253Hitachi Vantara Pentaho Data Integration & Analytics version…7.7
Are you affected by CVE-2026-2252?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST