CVE-2026-2252
Received Received - Intake
XXE Vulnerability in Xerox FreeFlow Core Enables SSRF Attack

Publication date: 2026-02-27

Last updated on: 2026-03-02

Assigner: Xerox

Description
An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7.  Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on -  https://www.support.xerox.com/en-us/product/core/downloads
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-27
Last Modified
2026-03-02
Generated
2026-06-16
AI Q&A
2026-02-27
EPSS Evaluated
2026-06-14
NVD
CVE-2026-2252
EUVD
EUVD-2026-9015
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
xerox freeflow_core to 8.1.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an XML External Entity (XXE) issue that allows a malicious user to perform Server-Side Request Forgery (SSRF). It occurs when crafted XML input containing malicious external entity references is processed by the affected software.

Specifically, the vulnerability affects Xerox FreeFlow Core versions up to and including 8.0.7.

Impact Analysis

The vulnerability can allow an attacker to perform SSRF attacks by exploiting the XXE flaw. This means an attacker could potentially make unauthorized requests from the server, which could lead to exposure of sensitive information or interaction with internal systems.

According to the CVSS score (7.5), the impact on confidentiality is high, but there is no impact on integrity or availability.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Xerox FreeFlow Core to version 8.1.0 or later.

This upgrade addresses the XML External Entity (XXE) vulnerability that allows Server-Side Request Forgery (SSRF) via crafted XML input.

The updated software can be downloaded from the official Xerox support site at https://www.support.xerox.com/en-us/product/core/downloads.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2252. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart