CVE-2026-18597 Foxit Software Inc. CVE debrief

Who should care

Organizations using Foxit PDF Services API, security teams responsible for monitoring and mitigating SSRF attacks, and operators managing affected deployments should be aware of this vulnerability. They should verify their configurations, restrict access to sensitive information, and implement additional security measures to prevent SSRF attacks. Vulnerability management and security teams should prioritize patching and review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and monitoring teams should check relevant logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. Rollback and change management teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Source tracking and incident response teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance and confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Security teams should also review the configurations of affected deployments and implement additional security measures to prevent SSRF attacks, such as validating user input and restricting access to sensitive information. Additionally, security teams should monitor for suspicious activity related to PDF creation and external file access and implement compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory teams should review the configurations of affected deployments and prioritize patching. Vulnerability management teams should review compensating controls for exposed systems while remediation is scheduled and verified. Monitoring teams should check relevant logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. Rollback and change management teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Source tracking and incident response

Technical summary

The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure. This vulnerability affects organizations using Foxit PDF Services API, particularly those with exposed deployments. The vulnerability is classified as an SSRF attack, which can lead to information disclosure.

Defensive priority

Organizations using Foxit PDF Services API should verify their configurations and restrict access to sensitive information.

Recommended defensive actions

• Verify Foxit PDF Services API configurations to restrict external file references.
• Implement additional security measures to prevent SSRF attacks.
• Monitor for suspicious activity related to PDF creation and external file access.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record indicates an SSRF vulnerability in Foxit PDF Services API's PDF creation feature, which could lead to information disclosure. However, details are limited, and further verification is needed. The vulnerability allows an attacker to trigger SSRF by using URL redirection to bypass validation. To verify, defenders should review Foxit PDF Services API configurations, check for suspicious activity related to PDF creation and external file access, and implement additional security measures to prevent SSRF attacks.

Official resources