CVE-2026-2252

HIGH7.5

XML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)

Published Feb 27, 2026

Modified 6 days ago

Details

An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references.

This issue affects Xerox FreeFlow Core versions up to and including 8.0.7.

Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads

References

WEB

https://securitydocs.business.xerox.com/wp-content/uploads/2026/02/Xerox-Security-Bulletin-026-005-for-Xerox-Freeflow-Core.pdf

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-2252

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

Input Validation

CWE-611

XXE (XML External Entity)

CWE-918

Server-Side Request Forgery (SSRF)

Ecosystems

Timeline

PublishedFeb 27, 2026

ModifiedFeb 27, 2026

CVE-2026-2252 | Mondoo Vulnerability Intelligence