What is the CVSS score of CVE-2026-18597?

CVE-2026-18597 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Foxit PDF Services are affected by CVE-2026-18597?

Foxit PDF Services API contains a Server-Side Request Forgery vulnerability (CVSS 8.5) that allows low-privileged remote attackers to access arbitrary internal resources and disclose sensitive data…

How to fix or mitigate CVE-2026-18597?

Within 24 hours, identify and inventory all internet-exposed Foxit PDF Services API instances and restrict network access to trusted clients only using firewall rules or API gateway authentication. Within 7 days, deploy Web Application Firewall (WAF) rules to detect and block SSRF payloads (including URL redirect chains and internal IP patterns), implement network segmentation to limit the API's access to only required backend systems, and enable detailed logging of all API requests. Within 30 days, monitor Foxit's security advisories for patch availability, test any released patch in a non-production environment, and plan a mandatory upgrade deployment across all Foxit PDF Services instances.

Foxit PDF Services CVE-2026-18597

EUVD-2026-53823 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-06 Foxit

GHSA-r64m-2vjm-2m73

Information Disclosure SSRF Foxit Pdf Services Api Foxit Software Inc

8.5

CVSS 3.1 · Vendor: Foxit

Severity by source

Vendor (Foxit) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

8.5 HIGH

Network-reachable API requiring low-privilege credentials; redirect bypass is low complexity; changed scope reflects SSRF reaching internal systems beyond API trust boundary.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (Foxit).

CVSS VectorVendor: Foxit

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 08:33 vuln.today

CVE Published

Aug 06, 2026 - 07:37 cve.org

HIGH 8.5

DescriptionCVE.org

The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure.

AnalysisAI

Server-Side Request Forgery in Foxit PDF Services API allows low-privileged remote attackers to bypass local file access restrictions by embedding redirect-chain URLs in PDF creation requests, causing the server to fetch arbitrary internal resources and disclose sensitive information. The CVSS vector (S:C/C:H) confirms the scope change extends to internal backend systems inaccessible to the attacker directly, making this a meaningful lateral-visibility primitive in environments where the API reaches internal network segments. No public exploit identified at time of analysis, and no KEV listing, though the low attack complexity elevates urgency for internet-exposed deployments.

Technical ContextAI

CWE-918 (Server-Side Request Forgery) arises when a server-side component fetches a user-supplied URL without adequately validating the final destination after redirects. Foxit PDF Services API (CPE: cpe:2.3:a:foxit_software_inc.:foxit_pdf_services_api:*:*:*:*:*:*:*:*) includes a PDF creation feature that accepts references to external files by URL. The product applies an allow/deny policy to restrict local file URIs, but the validation occurs only on the initial URL - not on the ultimate redirect target. An attacker submits a URL pointing to an attacker-controlled redirect service, which then issues an HTTP 301/302 to an internal address (e.g., http://169.254.169.254/metadata, http://internal-service/admin). The API follows the redirect, fetches that internal content, and includes it in the PDF output or error response, exfiltrating data across trust boundaries. The wide CPE version range ('*') indicates all known versions of the API are affected.

RemediationAI

Consult the Foxit security bulletins page at https://www.foxit.com/support/security-bulletins.html for the specific patch or updated API version addressing CVE-2026-18597 - no exact fixed version is confirmed from the available intelligence (upstream fix version not independently verified from the provided data). As a compensating control while awaiting a patch, configure egress firewall rules on the API server host to block outbound HTTP/HTTPS requests to RFC-1918 private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local addresses (169.254.0.0/16), and cloud metadata endpoints (169.254.169.254, fd00:ec2::254). Note this mitigates SSRF to internal networks but does not prevent SSRF to external attacker-controlled servers if the API is permitted general internet egress. If the PDF external file reference feature is not operationally required, disabling it entirely eliminates the attack surface - verify the trade-off against application functionality before doing so. Implementing an explicit allowlist of permitted URL domains at the application layer (rather than a denylist of bad destinations) is a more durable control than redirect-chain validation.