Xerox vulnerabilities
We track 11 vulnerabilities in Xerox products across 22 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on February 27, 2026.
Latest Xerox vulnerabilities
- 7.5 High severity
FreeFlow Core: Improper Restriction of XML External Entity Reference
An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Ple
- 9.8 Critical severity
FreeFlow Core: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to RCE. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upgr
- 9.8 Critical severity
FreeFlow Core: Improper Limitation of a Pathname to a Restricted Directory
In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution (RCE), allowing the attacker to run arbitrary commands on the system.
- 7.5 High severity
FreeFlow Core: Improper Restriction of XML External Entity Reference
In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).
- 7.6 High severity
Versalink B400: Missing Authentication for Critical Functionality
With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access.
- 7.5 High severity
Xerox Workplace Suite: Cleartext Storage of Sensitive Information
Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets without encryption
- 7.5 High severity
Xerox Workplace Suite: Use of Hard-coded Credentials
A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or forge tokens, leading to unauthorized access to sensitive functions.
- 9.8 Critical severity
Xerox Workplace Suite: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data
- 7.5 High severity
Xerox Workplace Suite: Authentication Bypass by Spoofing
In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthor
- 7.5 High severity
Xmpie Ustore: Improper Authentication
XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate into the application and exfiltrate sensitive information from th
- 7.5 High severity
Versalink Firmware: Loop with Unreachable Exit Condition
Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF file in an unauthenticated HTTP POST request. There is a permanent denial of service because image parsing causes a reboot,