Quick answer
Direct answer
Risk scores
| CVSS metric | What it means |
|---|---|
| Attack vector (AV:A) | Adjacent network |
| Attack complexity (AC:H) | High complexity |
| Privileges required (PR:N) | No privileges required |
| User interaction (UI:R) | A user must take an action |
| Scope (S:C) | Scope changed: impact spreads beyond the component |
| Confidentiality (C:H) | High confidentiality impact |
| Integrity (I:H) | High integrity impact |
| Availability (A:H) | High availability impact |
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
About Foxit Pdf Editor
CVE-2026-91812 affects Foxit Pdf Editor, a product from Foxit. Before acting, confirm where Foxit Pdf Editor runs in your estate, who owns it and whether it is reachable from the internet, because exposure decides real risk more than the score alone.
What the flaw is
In plain terms: A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges.
Based on its CVSS vector, the flaw needs local or adjacent access, needs no login, and relies on a user taking an action. Apply the vendor fix and confirm exposure on internet facing and business critical assets first.
Affected versions and timeline
| Field | Detail |
|---|---|
| Product | Foxit Pdf Editor |
| Affected versions | Pdf Editor up to and including 13.2.5.63482; Pdf Editor from 14.0.0.33046 up to and including 14.0.7.33751; Pdf Editor from 2023.1.0.15510 up to and including 2023.3.0.23028; Pdf Editor from 2024.1.0.23997 up to and including 2024.4.1.27687; Pdf Editor from 2025.1.0.27937 up to and including 2025.3.0.35737; Pdf Editor from 2026.1.0.36452 up to and including 2026.2.0.39747; Pdf Reader up to and including 2026.2.0.39747 |
| Published | Sep 23, 2026 |
| Last modified | Oct 8, 2026 |
| Added to CISA KEV | Not listed |
| Assigning CNA | 14984358-7092-470d-8f34-ade47a7658a2 |
How to detect it
- Inventory every instance of Foxit Pdf Editor and record the running version against the affected range above.
- Check external attack surface scans for internet facing instances of the component.
- Review logs on affected systems for unusual requests, errors or new processes around the vulnerable function.
- Confirm with an authenticated vulnerability scan once your scanner has a check for this CVE.
How to fix it
- Apply the fixed version of Foxit Pdf Editor named in the vendor advisory.
- If patching must wait, restrict network access to the affected service and put it behind authentication or a web application firewall rule.
- Rescan after the change to prove the exposure is gone, then close the ticket.
CTEM action plan
| CTEM stage | What to do for this CVE |
|---|---|
| Scope | Add every business service that depends on Foxit Pdf Editor to the current CTEM cycle. |
| Discover | Find all instances, including shadow and cloud deployments, and record versions and exposure. |
| Prioritize | Rank using EPSS and CVSS together with asset exposure and business impact. |
| Validate | Confirm the flaw is reachable and exploitable in your environment and that compensating controls work. |
| Mobilize | Assign the fix to the asset owner with a due date matched to the priority, then verify closure. |
CWE References
Technical References
Frequently asked questions
Related CVEs
A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges.
A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writable directory during high-privilege operations. A local attacker could exploit this issue to execute code with elevated privileges.
The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opportunity to elevate their privileges to NT AUTHORITY\SYSTEM.
When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution.
Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leading to invalid memory writes and program crashes during internal data structure construction.
An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment.
Earn your free CTEM certification.
Learn to scope, prioritize, validate and mobilize fixes for CVEs like CVE-2026-91812 with a free CTEM certification.
Beginner / Practitioner / Program Leader
Explore certifications