PT-2026-22315 · Xerox · Xerox Freeflow Core

Published 2026-02-27 · Updated 2026-03-04 · CVE-2026-2252

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xerox FreeFlow Core versions up to and including 8.0.7

Description An XML External Entity (XXE) issue allows a malicious user to perform Server-Side Request Forgery (SSRF) by submitting specially crafted XML input that includes malicious external entity references. This allows an attacker to potentially make requests to internal or external resources on behalf of the server.

Recommendations Upgrade to Xerox FreeFlow Core version 8.1.0.

Fix

XXE

SSRF

Weakness Enumeration

CWE-611

CWE-918

Related Identifiers

CVE-2026-2252

Affected Products

Xerox Freeflow Core

References · 6

• https://osv.dev/vulnerability/CVE-2026-2252 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2252 · Security Note
• https://securitydocs.business.xerox.com/wp-content/uploads/2026/02/Xerox-Security-Bulletin-026-005-for-Xerox-Freeflow-Core.pdf · Vendor Advisory
• https://twitter.com/CVEnew/status/2027380175051083963 · Twitter Post
• https://t.me/CVEtracker/45958 · Telegram Post
• https://twitter.com/cracbot/status/2029150014078128534 · Twitter Post