Loading story…
Foxit disclosed CVE-2026-18597, a high-severity blind server-side request forgery (SSRF) flaw in Foxit PDF Services API that affects versions released before 2026-07-27. The vulnerability resides in the product’s PDF creation feature, which can reference external files and be abused through URL redirection bypasses to make server-side requests. The issue is tracked as CWE-918 and carries a CVSS v3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, indicating a network-reachable flaw that can cause significant information disclosure with limited integrity impact.
Public advisories, including Foxit’s security bulletin and a Canadian Centre for Cyber Security notice, urged organizations using the API to review the vendor guidance and apply the available updates. The reported impact is primarily information disclosure, with the SSRF condition potentially allowing attackers with low privileges to coerce vulnerable servers into accessing unintended internal or external resources during PDF generation workflows.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On August 6, 2026, the Canadian Centre for Cyber Security published advisory AV26-784 covering the Foxit PDF Services API vulnerability. The advisory told users and administrators to review Foxit's bulletin and apply the necessary updates.
A new vulnerability entry, CVE-2026-18597, was recorded on August 6, 2026 for a blind SSRF affecting Foxit PDF Services API. The entry describes exploitation through the PDF creation feature and classifies the issue as CWE-918.
Foxit PDF Services API versions before 2026-07-27 are identified as affected by CVE-2026-18597, indicating the issue was addressed in version 2026-07-27 or later. The flaw is a blind SSRF in the PDF creation feature that can lead to information disclosure via URL redirection bypasses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecvefeed.io
Open sourcefoxit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at **Novee** reported **16 vulnerabilities** affecting widely deployed PDF platforms **Apryse WebViewer** (formerly PDFTron) and **Foxit PDF cloud services/SDK components**, warning they could be exploited for **account hijacking, data theft, and in some cases remote code execution**. Reported issue classes include **DOM-based, stored, and reflected XSS**, **server-side request forgery (SSRF)**, **path traversal**, and **OS command injection**; testing indicated attackers could trigger exploitation via **crafted documents, messages, or URLs**, with elevated risk when these viewers are embedded inside **authenticated enterprise applications** and trusted domains. Technical details highlighted that Apryse WebViewer spans multiple trust boundaries (a React-based iframe UI ingesting untrusted inputs such as query strings and `postMessage`, a JavaScript/WebAssembly document engine, and server-side SDK services), and that insufficient validation across these boundaries enabled exploitation paths. The most severe issue described was a **critical OS command injection (CVSS 9.8)** in Foxit’s Node.js signature server component, where a POST body parameter was reportedly concatenated into a command execution path. Both **Apryse** and **Foxit** stated the findings were **responsibly disclosed** and addressed via **patches, updates, and configuration changes**, with additional security hardening performed during remediation.
Jun 29, 2026
Foxit released security updates for *Foxit PDF Editor Cloud* (and related *Foxit eSign* components) to address two **cross-site scripting (XSS)** flaws that could allow **arbitrary JavaScript execution** in a victim’s browser when handling crafted content. The issues are tracked as **CVE-2026-1591** and **CVE-2026-1592** (both **CWE-79**) and were attributed to insufficient input validation and improper output encoding that allowed untrusted data to be embedded into the application’s HTML. The vulnerable functionality includes the **File Attachments list** and **Layers panel**, where attackers could inject payloads via crafted attachment filenames or manipulated layer names inside PDFs, requiring **user interaction** (e.g., opening/interacting with malicious documents) and typically **authenticated** access. Both CVEs are rated **moderate severity** with **CVSS v3.0 6.3**; exploitation could expose sensitive information available to the user’s session (e.g., document contents and session data). Foxit’s guidance is to ensure affected services are updated; the most recent referenced update for PDF Editor Cloud was released **February 3, 2026**.
Jun 29, 2026
German authorities published advisories for **multiple vulnerabilities** affecting **Foxit PDF Reader** and **Foxit PDF Editor**, indicating ongoing security issues across the vendor's desktop PDF products. The notices identify separate advisory entries, `2026-0914` and `2026-1256`, covering flaws in both **Reader** and **Editor** and signaling that organizations using Foxit software should review the affected versions and available vendor guidance. The repeated disclosures suggest a broader patch-management concern for enterprises that rely on Foxit for document handling, particularly because PDF applications are common targets for malicious document-based exploitation. Security teams should prioritize validating installed Foxit versions, applying relevant updates, and monitoring for suspicious PDF-related activity on endpoints where Foxit Reader or Editor is deployed.
Jun 29, 2026