Skip to content
OpenAdvisories

Vendor

Xerox

23 known vulnerabilities.

Xerox at a glance

Last 12 months
3
Critical · all time
4
Exploited · all time
0
Public exploit · all time
2
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 3 vulnerabilities, 1 critical March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202631
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202521
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202510
Feb 202520
Jan 202570
Dec 202400

Products

FreeFlow Core 9 Xerox Workplace Suite 7 AltaLink B8045/B8055/B8065/B8075/B8090 2 AltaLink C8030/C8035/C8045/C8055/C8070 2 WorkCentre 3655 2 WorkCentre 5845/5855/5865/5875/5890 2 WorkCentre 5945/5955 2 WorkCentre 6655 2 WorkCentre 7220/7225 2 WorkCentre 7830/7835/7845/7855 2 WorkCentre 7970 2 WorkCentre EC7836/EC7856 2 ColorQube 9301/9302/9303 2 ColorQube 8700/8900 2 WorkCentre 6400 2 Phaser 6700 2 Phaser 7800 2 WorkCentre 5735/5740/5745/5755/5765/5775/5790 2 WorkCentre 7525/7530/7535/7545/7556 2 WorkCentre 7755/7765/7775 2 Versalink B400 2 Versalink B405 2 Versalink C400 2 Versalink C405 2 Versalink B600/B610 2 Versalink B605/B615 2 Versalink C500/C600 2 Versalink C505/C605 2 Versalink C7000 2 Versalink C7020/C7025/C7030 2 Versalink B7025/B7030/B7035 2 Versalink B7125/B7130/B7135 2 Versalink C7120/C7125/C7130 2 Versalink C8000/C9000 2 Versalink C8000W 2 Phaser 6510 2 WorkCentre 6515 2 AltaLink® B8045 / B8055 / B8065 / B8075 / B8090 | C8030 / C8035 / C8045 / C8055 / C807 1 Xerox® EC8036 / EC8056 1 Xerox® EC8036 / EC8056 - Common Criteria (June 2022) 1

Latest advisories

  • Critical max 9.2
    WID-SEC-2026-4055 2 CVEs 2 exploited rev. 9

    PHP: Mehrere Schwachstellen ermöglichen Codeausführung

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um Speicherinhalte offenzulegen, einen Denial-of-Service-Zustand auszulösen oder beliebigen Code auszuführen.

    Google Oracle IBM Red Hat F5 Linux Windows
    first Oct 20, 2026
  • High max 9.8
    WID-SEC-2026-1354 11 CVEs rev. 56

    Apache HTTP Server: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um erweiterte Privilegien zu erlangen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu ver…

    Microsoft Oracle IBM Red Hat Dell Windows
    first May 4, 2026
  • Medium max 7.3
    WID-SEC-2024-0801 2 CVEs rev. 61

    Apache HTTP Server: Mehrere Schwachstellen ermöglichen Manipulation von Daten

    Ein Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um Daten zu manipulieren.

    Oracle IBM Red Hat Dell HCL Software Linux Windows
    first Apr 4, 2024
  • High max 9.1
    WID-SEC-2025-1529 9 CVEs rev. 80

    Apache HTTP Server: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um Dateien zu manipulieren.

    Oracle IBM Red Hat Dell QNAP Systems Linux Windows
    first Jul 10, 2025
  • High max 9.8
    WID-SEC-2026-1824 13 CVEs rev. 46

    Apache HTTP Server: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu verändern und offenzulegen, einen Denial-of-Service-Zusta…

    Microsoft Oracle IBM Red Hat Dell Windows
    first Jun 8, 2026
All Critical High Medium Low Exploited only Public exploit

23 results · Feed

  • High 7.5
    CVE-2026-2252

    XML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)

    An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7.  P…

    Xerox FreeFlow Core
  • Critical 9.8
    CVE-2026-2251

    Path Traversal leading to Remote Code Execution (RCE)

    Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to RCE. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upg…

    Xerox FreeFlow Core
  • Medium 5.3
    CVE-2026-1769 Public exploit

    Stored XSS on Xerox CentreWare Web 7.0.6

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xerox CentreWare on Windows allows Stored XSS.This issue affects CentreWare: through 7.0.6.  Consider upgrading Xerox® CentreWare Web® to v7.2.2.25 vi…

    Xerox CentreWare
  • Critical 9.8
    CVE-2025-8356 EPSS 23%

    Path Traversal leading to RCE

    In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution (RCE), allowing the attacker to run arbitrary commands on the system.

    Xerox FreeFlow Core
  • High 7.5
    CVE-2025-8355 EPSS 11%

    XXE leading to SSRF

    In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).

    Xerox FreeFlow Core
  • Medium 5.2
    CVE-2025-1984

    Local Privilege Escalation on Xerox® Desktop Print Experience® v8.5

    Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level access.

    Xerox Xerox® Desktop Print Experience
  • High 7.6
    CVE-2024-12511

    SMB/FTP Address Book Scan Pass-back attack

    With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access.

    Xerox Versalink C8000W Versalink C505/C605 Versalink B400
  • Medium 6.7
    CVE-2024-12510

    LDAP Authentication Sever Pass-back attack

    If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active LDAP setup.

    Xerox Versalink B400 WorkCentre 6515 Versalink C7020/C7025/C7030
  • Medium 6.5
    CVE-2024-55931

    Token stored in session storage

    Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised.  The patch for this vulnerability will be included in a future release of Workplace Suite, and customers will be notified thr…

    Xerox Xerox Workplace Suite
  • Medium 6.7
    CVE-2024-55930

    Weak default folder permissions

    Xerox Workplace Suite has weak default folder permissions that allow unauthorized users to access, modify, or delete files

    Xerox Xerox Workplace Suite
  • Medium 5.3
    CVE-2024-55929

    Mail spoofing

    A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sources.

    Xerox Xerox Workplace Suite
  • Medium 6.5
    CVE-2024-55928

    Clear text secrets returned & Remote system secrets in clear text

    Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets without encryption

    Xerox Xerox Workplace Suite
  • High 7.6
    CVE-2024-55927

    Flawed token generation implementation & Hard-coded key implementation

    A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or forge tokens, leading to unauthorized access to sensitive functions.

    Xerox Xerox Workplace Suite
  • High 7.6
    CVE-2024-55926

    Arbitrary file upload, deletion and read through header manipulation

    A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data

    Xerox Xerox Workplace Suite
  • High 7.5
    CVE-2024-55925

    API Security bypass through header manipulation

    In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unautho…

    Xerox Xerox Workplace Suite
  • High 7.2
    CVE-2024-6333 Public exploit

    Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products

    Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products.

    Xerox Xerox® EC8036 / EC8056 WorkCentre 7830/7835i Xerox® EC8036 / EC8056 - Common Criteria (June 2024)
  • High 7.6
    CVE-2024-47559

    Authenticated RCE via Path Traversal

    Authenticated RCE via Path Traversal

    Xerox FreeFlow Core
  • High 7.6
    CVE-2024-47558

    Authenticated RCE via Path Traversal

    Authenticated RCE via Path Traversal

    Xerox FreeFlow Core
  • High 8.3
    CVE-2024-47557

    Pre-Auth RCE via Path Traversal

    Pre-Auth RCE via Path Traversal

    Xerox FreeFlow Core
  • High 8.3
    CVE-2024-47556

    Pre-Auth RCE via Path Traversal

    Pre-Auth RCE via Path Traversal

    Xerox FreeFlow Core
  • High 8.3
    CVE-2024-47555

    Missing Authentication - User & System Configuration

    Missing Authentication - User & System Configuration

    Xerox FreeFlow Core
  • Critical 9.4
    CVE-2019-10881

    Default hidden Privileged Account Vulnerability in multiple XEROX devices

    Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includes two accounts with weak hard-coded passwords which can be exploited and allow unauthorized access which cannot be disa…

    Xerox WorkCentre 7830/7835/7845/7855 AltaLink B8045/B8055/B8065/B8075/B8090 WorkCentre 7525/7530/7535/7545/7556
  • Critical 9.8
    CVE-2019-10880

    Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" use…

    Xerox WorkCentre 5945/5955 Phaser 6700 WorkCentre 7220/7225