What is the CVSS score of CVE-2026-2251?

CVE-2026-2251 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Freeflow Core are affected by CVE-2026-2251?

A critical remote code execution vulnerability (CVE-2026-2251) affects Xerox FreeFlow Core versions up to 8.0.7, allowing attackers to gain unauthorized system access through path traversal…

How to fix or mitigate CVE-2026-2251?

Within 24 hours: Inventory all Xerox FreeFlow Core installations and identify systems running versions 8.0.7 or earlier; isolate affected systems from production networks if possible and enable enhanced logging. Within 7 days: Implement network segmentation to restrict external access to FreeFlow Core servers; deploy WAF rules to block suspicious path traversal patterns; contact Xerox for ETA on security patches and interim guidance. Within 30 days: Apply vendor patch immediately upon release; conduct forensic analysis for potential compromise indicators; review access logs for exploitation attempts during the vulnerable exposure period.

Freeflow Core CVE-2026-2251

CRITICAL

Path Traversal (CWE-22)

2026-02-27 10b61619-3869-496c-8a1e-f291b0e71e3f

Path Traversal Freeflow Core

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 09:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to RCE. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7.

Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads

https://www.support.xerox.com/en-us/product/core/downloads

AnalysisAI

Path traversal vulnerability in Xerox FreeFlow Core allows attackers to access files outside restricted directories, potentially exposing sensitive print job data and system configurations.