Xerox vulnerabilities and fixes

CVEs that mention Xerox, ranked by priority. 17 tracked.

Xerox has 17 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 13. Most recent: 2026-02-27. Highest priority: CVE-2025-8356 (score 70/100).

• CVE-2025-8356 CRITICAL 9.8 DOWNGRADE In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unautho
• CVE-2025-8355 HIGH 7.5 DOWNGRADE In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities
• CVE-2026-2251 CRITICAL 9.8 UPGRADE Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow C
• CVE-2024-47556 HIGH 8.3 UPGRADE Pre-Auth RCE via Path Traversal
• CVE-2024-47557 HIGH 8.3 UPGRADE Pre-Auth RCE via Path Traversal
• CVE-2024-55925 HIGH 7.5 UPGRADE In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header
• CVE-2024-47558 HIGH 7.6 DOWNGRADE Authenticated RCE via Path Traversal
• CVE-2024-47559 HIGH 7.6 DOWNGRADE Authenticated RCE via Path Traversal
• CVE-2026-2252 HIGH 7.5 UPGRADE An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF)
• CVE-2024-55926 HIGH 7.6 UPGRADE A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server
• CVE-2024-55927 HIGH 7.6 UPGRADE A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys
• CVE-2024-55931 MEDIUM 6.5 UPGRADE Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's
• CVE-2024-55930 MEDIUM 6.7 UPGRADE Xerox Workplace Suite has weak default folder permissions that allow unauthorized users to access, modify, or
• CVE-2024-55929 MEDIUM 5.3 UPGRADE A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appe
• CVE-2024-55928 MEDIUM 6.5 UPGRADE Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely
• CVE-2026-1769 MEDIUM 5.3 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in X
• CVE-2025-1984 MEDIUM 5.2 Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which al

FAQ

How do I fix Xerox vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Xerox being exploited right now?

None of the tracked Xerox CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Xerox CVE should I patch first?

CVE-2025-8356 currently ranks highest (70/100): In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unautho.

RSS feed for Xerox · ← Back to latest CVEs