Is CVE-2026-91800 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91800 being exploited in the wild.

How severe is CVE-2026-91800?

High severity, with a CVSS score of 8.8, published 23 September 2026.

Which products and versions are affected?

Foxit PDF Editor 2026.2.0 and earlier, 2025.3.0 and earlier, 2024.4.1 and earlier, 2023.3.0 and earlier, 14.0.7 and earlier, 13.2.6 and earlier.

Is there a fix for CVE-2026-91800?

A patch was published on 2026-09-23: Foxit PDF Editor 2026.2.1 and 14.0.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91800 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-91800?

Check whether you run Foxit PDF Editor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91800: Foxit PDF Editor privilege escalation in installer on macOS

CVE-2026-91800 · Severity: high · CVSS 8.8 · Published 2026-09-23

Foxit PDF Editor's macOS installer contains a local privilege escalation vulnerability that allows an attacker with local access to execute arbitrary commands with root privileges. An attacker could gain complete control of the system by exploiting insufficient validation of configuration values during software upgrades, potentially leading to data theft, malware installation, or system compromise.

Technologies: Foxit PDF Editor. Vendors: Foxit.

Quick answers

Is CVE-2026-91800 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91800 being exploited in the wild.
How severe is CVE-2026-91800?: High severity, with a CVSS score of 8.8, published 23 September 2026.
Which products and versions are affected?: Foxit PDF Editor 2026.2.0 and earlier, 2025.3.0 and earlier, 2024.4.1 and earlier, 2023.3.0 and earlier, 14.0.7 and earlier, 13.2.6 and earlier.
Is there a fix for CVE-2026-91800?: A patch was published on 2026-09-23: Foxit PDF Editor 2026.2.1 and 14.0.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91800 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-91800?: Check whether you run Foxit PDF Editor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the installer's upgrade mechanism due to insufficient validation of a user-modifiable configuration value that is processed with elevated privileges. A local, unauthenticated attacker can exploit this during high-privilege upgrade operations to execute arbitrary code as root. A patch is available in Foxit PDF Editor 2026.2.1 and later versions.

Affected products

Foxit PDF Editor 2026.2.0 and earlier, 2025.3.0 and earlier, 2024.4.1 and earlier, 2023.3.0 and earlier, 14.0.7 and earlier, 13.2.6 and earlier

Timeline

2026-09-23: disclosed: CVE-2026-91800 published
2026-09-23: patched: Foxit PDF Editor 2026.2.1 and 14.0.8 released

References

https://www.foxit.com/support/security-bulletins.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.