CVE Intelligence
Analysis AI-assisted

CVE-2026-5936: Foxit PDF Services API SSRF via URL Parameter

A Server-Side Request Forgery flaw (CWE-918) in the Foxit PDF Services API allows a crafted URL to make the server send requests to arbitrary destinations. NVD rates it 9.8 (critical) under CVSS, and the record lists builds before 2026-04-07 as affected. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-5936 is a Server-Side Request Forgery (SSRF) weakness, classified as CWE-918, in the Foxit PDF Services API. According to the record, a crafted URL supplied to the service can make the server issue HTTP requests to destinations chosen by the caller.

Impact

  • The record describes possible probing of internal network services, access to endpoints otherwise unreachable from outside, and bypass of network access controls.
  • Sensitive information disclosure and further compromise of the internal environment are described as potential outcomes.
  • NVD scores the issue 9.8 (critical) under CVSS, with a vector indicating network reachability, no privileges required, no user interaction, and high confidentiality, integrity and availability impact. Another provider in the record scores it 8.5.

Affected products and versions

  • The record lists Foxit PDF Services API versions before 2026-04-07 as affected.
  • The record contains no fixed version. The vendor bulletin is the primary source to confirm whether 2026-04-07 is the corrected release.

Exploitation status

  • CISA KEV does not list this CVE in the record, so no active exploitation is confirmed by that source.
  • SSVC fields in the record show exploitation as none and automatable as no. The EPSS probability is 0.00344.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Review the vendor security bulletin and inventory all Foxit PDF Services API deployments.
  • Plan an upgrade to a release dated 2026-04-07 or later, after confirming the fix with the vendor.
  • Restrict the outbound destinations the service can reach to those required for normal operation.
  • Limit access from the service host to internal metadata and management endpoints.
  • Validate and restrict which URLs callers are allowed to submit.

Detection guidance

  • Review service and network logs for requests where the service fetches internal, loopback or otherwise unexpected addresses.
  • Monitor outbound connections from the API host for destinations that are outside normal business workflows.

Limitations of the available information

  • The record does not identify the specific parameter, endpoint or preconditions for the flaw.
  • The record lists no fixed version and no patch reference beyond the general vendor bulletin.
  • The record contains no exploit details, and this analysis does not provide any.

Frequently asked questions

What is the main risk of CVE-2026-5936?

The record describes an SSRF flaw that lets a crafted URL make the server send requests to arbitrary destinations, which could expose internal services or sensitive information.

Which versions are affected?

The record lists Foxit PDF Services API versions before 2026-04-07 as affected. Confirm the corrected release with the vendor bulletin, since the record lists no fixed version.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.