CVE-2026-2252

—

CVSS 3.1

7.5 high

EPSS

<1%p18

Published

Feb 27, 2026 (Feb 27, 2026)

Modified

Jun 17, 2026

Description

An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads

Vendors: xerox
Products: freeflow core
Weakness: CWE-611, CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.