Freeflow Core CVE-2026-2252
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references.
This issue affects Xerox FreeFlow Core versions up to and including 8.0.7.
Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads
AnalysisAI
Xerox FreeFlow Core versions through 8.0.7 contain an XML External Entity (XXE) vulnerability that allows unauthenticated remote attackers to conduct Server-Side Request Forgery attacks by submitting malicious XML input. This vulnerability could enable attackers to access internal resources or sensitive data on the affected system. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all instances of Xerox FreeFlow Core in production and their version numbers; implement network segmentation to restrict outbound connections from affected systems. Within 7 days: Disable XML external entity processing if the feature is not business-critical; deploy WAF rules to block XXE payloads in XML input; establish enhanced monitoring for suspicious outbound connections. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today