CERT-FR: Multiple vulnerabilities in Foxit Online Services allow data compromise and SSRF (CVE-2026-111417/18/19)
The French CERT-FR published advisory CERTFR-2026-AVI-1418 on 29 October 2026 about multiple vulnerabilities in Foxit Online Services. According to the advisory, some of the flaws let an attacker compromise data confidentiality and integrity, bypass the security policy and carry out server-side request forgery (SSRF). The advisory states that no user action is required, which suggests the fixes are applied on the vendor side. It does not mention exploitation in the wild.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1418 covers three CVEs in Foxit Online Services: CVE-2026-111417, CVE-2026-111418 and CVE-2026-111419. It says some of them let an attacker compromise data confidentiality and integrity, bypass the security policy and perform server-side request forgery (SSRF). It does not say which CVE does what, and it gives no CVSS scores, affected or fixed versions, or attacker requirements. It states that no user action is required, which suggests the fixes are applied by the vendor. Details are in the Foxit security bulletin of 29 October 2026.
Como foi descoberta
The CERT-FR advisory only says the vulnerabilities were discovered in Foxit Online Services. It does not say who found them or how, nor when they were reported. They became public on 29 October 2026 through the Foxit security bulletin and the CERT-FR advisory published that day. The advisory does not mention exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 12:21.
Detalhes técnicos
- CVEs referenced: CVE-2026-111417, CVE-2026-111418, CVE-2026-111419.
- Impact classes: confidentiality breach, integrity breach, security policy bypass, SSRF.
- The advisory gives no CVSS scores, root causes or per-CVE details.
Remediação
- Consult the Foxit security bulletin of 29 October 2026 (security-bulletins.php) for fixes and details.
Linha do tempo
-
CERT-FR: Multiple vulnerabilities in Foxit Online Services allow data compromise and SSRF (CVE-2026-111417/18/19)
ler a análise desta fonte ocultar
The French CERT-FR published advisory CERTFR-2026-AVI-1418 on 29 October 2026 about multiple vulnerabilities in Foxit Online Services. According to the advisory, some of the flaws let an attacker compromise data confidentiality and integrity, bypass the security policy and carry out server-side request forgery (SSRF). The advisory states that no user action is required, which suggests the fixes are applied on the vendor side. It does not mention exploitation in the wild.
Technical Details
- CVEs referenced: CVE-2026-111417, CVE-2026-111418, CVE-2026-111419.
- Impact classes: confidentiality breach, integrity breach, security policy bypass, SSRF.
- The advisory gives no CVSS scores, root causes or per-CVE details.
Remediation
- Consult the Foxit security bulletin of 29 October 2026 (security-bulletins.php) for fixes and details.