CVE-2025-8356

9.8 criticalEPSS 19%

Critical (9.8) in xerox freeflow core. EPSS 19% chance of exploitation in the next 30 days.

In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution (RCE), allowing the attacker to run arbitrary commands on the system.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 19% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWEs: CWE-22, CWE-94
Published: 2025-08-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

xerox:freeflow_core

References

https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf
https://horizon3.ai/attack-research/attack-blogs/from-support-ticket-to-zero-day/

Check your stack JSON