CVE-2026-2252: xerox freeflow_core
Vulnerability summary
CVE-2026-2252 is a high (CVSS 7.5) vulnerability in xerox freeflow_core. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 18.8% of scored vulnerabilities.
Timeline
- 27-02-2026PublishedVulnerability first disclosed.
- 06-03-2026Last modifiedVulnerability information updated.
Description
An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
19%
Versus all other CVEs
30-day change
+0.01 pp
From 0.27% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
Xerox1 product
- freeflow_core≤ 8.0.7 | < 8.1.0
1 vendor · 1 product
References
1 links- securitydocs.business.xerox.com/wp-content/…Vendor Advisory