CVE-2026-2252

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2252", "assignerOrgId": "10b61619-3869-496c-8a1e-f291b0e71e3f", "state": "PUBLISHED", "assignerShortName": "Xerox", "dateReserved": "2026-02-09T14:29:08.541Z", "datePublished": "2026-02-27T08:18:17.816Z", "dateUpdated": "2026-03-06T15:34:24.049Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "FreeFlow Core", "vendor": "Xerox", "versions": [{"lessThanOrEqual": "8.0.7", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references.\n\n<p><span style=\"background-color: rgb(252, 252, 252);\">This issue affects Xerox FreeFlow Core versions up to and including 8.0.7.&nbsp;</span></p><p><span style=\"background-color: rgb(252, 252, 252);\">Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on -&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.support.xerox.com/en-us/product/core/downloads\">https://www.support.xerox.com/en-us/product/core/downloads</a></span>\n\n</p>"}], "value": "An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references.\n\nThis issue affects Xerox FreeFlow Core versions up to and including 8.0.7.\u00a0\n\nPlease consider upgrading to FreeFlow Core version 8.1.0 via the software available on -\u00a0 https://www.support.xerox.com/en-us/product/core/downloads"}], "impacts": [{"capecId": "CAPEC-201", "descriptions": [{"lang": "en", "value": "CAPEC-201 Serialized Data External Linking"}]}, {"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server Side Request Forgery"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "10b61619-3869-496c-8a1e-f291b0e71e3f", "shortName": "Xerox", "dateUpdated": "2026-02-27T08:18:38.491Z"}, "references": [{"url": "https://securitydocs.business.xerox.com/wp-content/uploads/2026/02/Xerox-Security-Bulletin-026-005-for-Xerox-Freeflow-Core.pdf"}], "source": {"discovery": "UNKNOWN"}, "title": "XML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T19:27:58.048822Z", "id": "CVE-2026-2252", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T15:34:24.049Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2252", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-03T19:27:58.048822Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T15:34:20.464Z"}}], "cna": {"title": "XML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-201", "descriptions": [{"lang": "en", "value": "CAPEC-201 Serialized Data External Linking"}]}, {"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server Side Request Forgery"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Xerox", "product": "FreeFlow Core", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.0.7"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://securitydocs.business.xerox.com/wp-content/uploads/2026/02/Xerox-Security-Bulletin-026-005-for-Xerox-Freeflow-Core.pdf"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references.\n\nThis issue affects Xerox FreeFlow Core versions up to and including 8.0.7.\u00a0\n\nPlease consider upgrading to FreeFlow Core version 8.1.0 via the software available on -\u00a0 https://www.support.xerox.com/en-us/product/core/downloads", "supportingMedia": [{"type": "text/html", "value": "An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references.\n\n<p><span style=\"background-color: rgb(252, 252, 252);\">This issue affects Xerox FreeFlow Core versions up to and including 8.0.7.&nbsp;</span></p><p><span style=\"background-color: rgb(252, 252, 252);\">Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on -&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://www.support.xerox.com/en-us/product/core/downloads\">https://www.support.xerox.com/en-us/product/core/downloads</a></span>\n\n</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "10b61619-3869-496c-8a1e-f291b0e71e3f", "shortName": "Xerox", "dateUpdated": "2026-02-27T08:18:38.491Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2252", "state": "PUBLISHED", "dateUpdated": "2026-03-06T15:34:24.049Z", "dateReserved": "2026-02-09T14:29:08.541Z", "assignerOrgId": "10b61619-3869-496c-8a1e-f291b0e71e3f", "datePublished": "2026-02-27T08:18:17.816Z", "assignerShortName": "Xerox"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FreeFlow Core", "vendor": "Xerox", "versions": [{"lessThanOrEqual": "8.0.7", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "10b61619-3869-496c-8a1e-f291b0e71e3f"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:xerox:freeflow_core:*:*:*:*:*:*:*:*", "matchCriteriaId": "BB016BFC-2C5B-4CFA-BC3C-B5A9DBF893F1", "versionEndExcluding": "8.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references.\n\nThis issue affects Xerox FreeFlow Core versions up to and including 8.0.7.\u00a0\n\nPlease consider upgrading to FreeFlow Core version 8.1.0 via the software available on -\u00a0 https://www.support.xerox.com/en-us/product/core/downloads"}, {"lang": "es", "value": "Una vulnerabilidad de Entidad Externa XML (XXE) permite a un usuario malintencionado realizar una falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) a trav\u00e9s de una entrada XML manipulada que contiene referencias a entidades externas maliciosas.\n\nEste problema afecta a las versiones de Xerox FreeFlow Core hasta la 8.0.7 inclusive.\n\nConsidere actualizar a la versi\u00f3n 8.1.0 de FreeFlow Core a trav\u00e9s del software disponible en - https://www.support.xerox.com/en-us/product/core/downloads"}], "id": "CVE-2026-2252", "lastModified": "2026-06-17T10:30:38.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "10b61619-3869-496c-8a1e-f291b0e71e3f", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2252", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T19:27:58.048822Z", "version": "2.0.3"}}]}, "published": "2026-02-27T09:16:17.130", "references": [{"source": "10b61619-3869-496c-8a1e-f291b0e71e3f", "tags": ["Vendor Advisory"], "url": "https://securitydocs.business.xerox.com/wp-content/uploads/2026/02/Xerox-Security-Bulletin-026-005-for-Xerox-Freeflow-Core.pdf"}], "sourceIdentifier": "10b61619-3869-496c-8a1e-f291b0e71e3f", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}, {"lang": "en", "value": "CWE-918"}], "source": "10b61619-3869-496c-8a1e-f291b0e71e3f", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.0.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FreeFlow Core", "source": "cna", "vendor": "Xerox"}, "product": "freeflow_core", "vendor": "xerox"}], "analysis": {"en": {"generated_at": "2026-04-16T15:29:38.805501+00:00", "value": {"mitigation_remediation": ["Update Xerox\u202fFreeFlow\u202fCore to version\u202f8.1.0 using the download from Xerox support.", "If the upgrade cannot be performed immediately, reconfigure the XML parser to reject all external entity references and disable external entity loading.", "Continuously monitor outbound traffic and system logs for unexpected internal or external connections that could indicate SSRF attempts."], "summary": {"action": "Patch Immediately", "impact": "Server\u2011Side Request Forgery via XML External Entity leading to potential internal network exposure"}, "threat_synthesis": {"affected_systems": "Xerox\u202fFreeFlow\u202fCore, versions up to and including\u202f8.0.7, are affected. The vendor recommends upgrading to version\u202f8.1.0 to remediate the issue.", "description_and_impact": "This vulnerability allows a malicious user to supply crafted XML containing external entity references, resulting in a server\u2011side request forgery (SSRF). The attacker can force the affected service to reach arbitrary internal or external resources, potentially exfiltrating data or enabling further compromise. The weakness is an XML External Entity (CWE\u2011611) that can be abused for SSRF (CWE\u2011918).", "risk_and_exploitability": "With a CVSS base score of\u202f7.5 the vulnerability is considered high. The EPSS indicates a very low exploitation probability (<1%) and it is not listed in the CISA KEV catalog, but the presence of SSRF capabilities still warrants prompt action. Exploitation is possible from remote input where the attacker can control XML payloads\u2014likely via any service that accepts XML input. Only basic network connectivity is required to trigger the SSRF."}}}}, "created": "2026-02-27T16:06:02.188925+00:00", "updated": "2026-04-16T15:30:06.231775+00:00", "vendors": ["xerox", "xerox$PRODUCT$freeflow_core"]}