Foxit PDF Editor Vulnerabilities Let Attackers Execute Arbitrary JavaScript

Foxit addressed two moderate-severity XSS vulnerabilities (CVE-2026-1591 and CVE-2026-1592) in Foxit PDF Editor Cloud that allow arbitrary JavaScript execution via unsanitized layer names and attachment filenames; exploitation requires user interaction and authenticated access and could expose document contents and session data. Cloud instances are auto-updated, desktop users should apply the February 3, 2026 patches, and organizations are advised to review file-handling practices and restrict editing privileges as appropriate.