Xerox vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-2252 An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious externHigh 7.5 · Feb 27, 2026
• CVE-2026-2251 Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to Critical 9.8 · Feb 27, 2026
• CVE-2025-8356 In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server.Critical 9.8 · Aug 8, 2025
• CVE-2025-8355 In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities.High 7.5 · Aug 8, 2025
• CVE-2024-12511 With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials.High 7.6 · Feb 3, 2025
• CVE-2024-55927 A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys.High 7.6 · Jan 23, 2025
• CVE-2024-55926 A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation.High 7.6 · Jan 23, 2025
• CVE-2024-55925 In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header.High 7.5 · Jan 23, 2025
• CVE-2024-6333 Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products.High 7.2 · Oct 17, 2024
• CVE-2024-47559 Authenticated RCE via Path TraversalHigh 7.6 · Oct 7, 2024
• CVE-2024-47558 Authenticated RCE via Path TraversalHigh 7.6 · Oct 7, 2024
• CVE-2024-47557 Pre-Auth RCE via Path TraversalHigh 8.3 · Oct 7, 2024
• CVE-2024-47556 Pre-Auth RCE via Path TraversalHigh 8.3 · Oct 7, 2024
• CVE-2024-47555 Missing Authentication - User & System ConfigurationHigh 8.3 · Oct 7, 2024
• CVE-2022-26572 Xerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to print, view the status, and obtain sensitive information.High 7.5 · Apr 4, 2022
• CVE-2021-37354 Xerox Phaser 4622 v35.013.01.000 was discovered to contain a buffer overflow in the function sub_3226AC via the TIMEZONE variable.Critical 9.8 · Feb 15, 2022
• CVE-2022-23320 XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries.High 7.5 · Feb 7, 2022
• CVE-2022-23968 Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF file in an unauthenticaHigh 7.5 · Jan 26, 2022
• CVE-2019-10881 Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includes two accounts with Critical 9.8 · Apr 13, 2021
• CVE-2021-28672 Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65.51 and 37.59.01 (BriCritical 9.8 · Mar 29, 2021
• CVE-2021-28671 Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65.51 and 37.59.01 (BriCritical 9.8 · Mar 29, 2021
• CVE-2021-28673 Xerox Phaser 6510 before 64.61.23 and 64.59.11 (Bridge), WorkCentre 6515 before 65.61.23 and 65.59.11 (Bridge), VersaLink B400 before 37.61.23 and 37.59.01 (BriCritical 9.8 · Mar 29, 2021
• CVE-2021-28669 Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 proHigh 7.5 · Mar 29, 2021
• CVE-2021-28668 Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 hasCritical 9.8 · Mar 29, 2021
• CVE-2021-28670 Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before 103.001.030.32000, C8045/C8055 before 103.002.030.32000 and C8070 before 103.003.030.320Critical 9.1 · Mar 29, 2021