CVE-2026-91796

Executive Summary

CVE-2026-91796 is a security-control bypass in the interface of Foxit PDF Editor/Reader: the application does not perform permission verification for "secure reading mode," allowing a specially crafted PDF to initiate outbound SMB authentication without displaying any security prompt. Because the forced authentication leaks the user's credential hash to an attacker-controlled SMB endpoint, the vulnerability enables offline credential cracking and, in relay configurations, direct authentication relay, with availability impact against the affected host scored as High (CVSS 6.1, CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Any organization where Foxit PDF Editor/Reader is deployed on endpoint workstations or servers is affected, and no patch or vendor fix is currently available.

Technical Analysis

The CVE record describes a missing authorization/permission check in the Foxit PDF Editor/Reader interface governing "secure reading mode." Secure reading mode is intended to restrict the actions a document can cause the application to perform when a user opens untrusted or externally sourced PDFs. In this case, the permission verification for that mode is absent in the interface logic, meaning the protective control is not enforced for the affected code path.

The consequence is a forced-authentication condition. A specially crafted PDF can cause the reader to initiate an outbound SMB authentication to a remote host specified within the document. Because the secure reading mode control is not verified, the transaction proceeds without any security prompt presented to the user, and the authentication exchange discloses the user's credential hash to the remote SMB service. This maps to CWE-693 (Protection Mechanism Failure): the security mechanism exists but is bypassed in the vulnerable implementation.

The flaw class is a client-side security-control bypass combined with forced authentication (MITRE ATT&CK T1187). Two properties make it operationally significant:

• No prompt, no consent. The user receives no warning before the outbound authentication occurs, so the trigger is silent and can be embedded in a document that otherwise appears benign.
• Outbound SMB egress. The reader reaches out to an attacker-specified SMB endpoint rather than the attacker having to reach into the host, meaning the technique works from behind NAT and typically escapes perimeter inspection because SMB is commonly permitted on internal networks and sometimes across trust boundaries.

The NVD description does not specify which version range is affected, the precise code path, or the exact PDF object or action used to induce the SMB request. Those details are not available from any tracked source at the time of writing. The CVSS vector confirms local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), and required user interaction (UI:R) — consistent with a technique where the user simply opens a document. Scope is unchanged (S:U), confidentiality impact is Low (C:L) because the credential hash must still be cracked or relayed before it becomes a usable secret, and availability impact is High (A:H), which in the SMB-authentication context corresponds to the host being driven into disruptive authentication behavior (lockouts/hangs) during repeated or malformed authentication exchange.

The mechanistic chain, at the vulnerability-class level, is: crafted PDF → reader parses document and reaches the authentication-inducing element → secure reading mode permission check is skipped → reader performs outbound SMB authentication to attacker-controlled host → NTLM credential hash is disclosed to that host.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code exists for CVE-2026-91796, and the CISA KEV catalog does not list it. The attack chain below is inferred from the vulnerability class (forced authentication via a client-side control bypass) and is constrained to what the NVD description supports; no fabricated function names, endpoints, or PDF internal object names are supplied, because none are present in the source data.

1. Reconnaissance / target identification. The adversary determines that the target organization uses Foxit PDF Editor/Reader. This is a widely deployed PDF client, so the work is largely about confirming it is present on endpoints and identifying a plausible delivery path: email attachment, shared file repository, web download, or a document portal. Because the missing check is in the client interface and the exploit is delivered as a document, the adversary does not need network reachability to the victim — only the ability to get a file opened.

2. Triggering the specific flaw class. The adversary crafts a PDF that contains the element which causes the reader to perform outbound SMB authentication (for example, a document-embedded resource reference that resolves to a UNC/SMB path). The crafted file is delivered to the victim. When the victim opens the PDF, the vulnerable interface fails to verify the secure reading mode permission, so the protective prompt that would normally appear is not shown. This is the core bypass: the control that should gate the outbound authentication is simply not enforced.

3. Payload / execution method at the vulnerability-class level. There is no code execution payload in the classic sense. The "payload" is the remote SMB endpoint controlled by the adversary. When the reader initiates the authentication transaction, the victim host performs an NTLM authentication exchange against the attacker's SMB listener. The adversary does not need to break any client-side exploitation mitigation; they only need an internet- or intranet-reachable SMB service and a means to deliver the document.

4. Post-exploitation impact. The attacker captures the NTLM credential hash (NetNTLMv1/v2) from the authentication attempt. Two exploitation paths follow: (a) offline cracking of the captured hash to recover the plaintext password, which requires cracking time and a sufficiently weak password, or (b) NTLM relay, where the captured authentication is relayed in real time to another service that honors NTLM (for example, SMB signing disabled, or AD CS/LDAP endpoints depending on the relay target configuration). Relay success depends on whether the relayed target enforces SMB signing and channel binding; those conditions are environmental, not properties of the CVE. Repeated forcing of authentication against an account also produces failed/duplicate authentication events that can drive account lockout — the mechanism behind the High availability subscore.

Constraints that honest assessment requires: confidentiality is scored Low, not High, because hash capture is not equivalent to credential compromise; crackability and relayability vary by password strength and target configuration. Public exploitation evidence is absent, so this should be treated as a credible technique-of-opportunity rather than a confirmed active campaign.

Impact Assessment

Direct technical impact. The vulnerability yields disclosure of the user's credential material (NTLM hash) to an attacker-controlled SMB service, without any prompt to the user. CVSS 3.1 score is 6.1 (Medium), vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H:

• AV:L — the attack originates from the local context of the victim's interaction (the user opening a document).
• AC:L — no special conditions or racing required beyond successful delivery.
• PR:N — no prior credentials or privileged access needed by the attacker.
• UI:R — the user must open the crafted PDF.
• S:U — impact is confined to the vulnerable component's security authority.
• C:L — credential hash disclosure, not direct secret recovery.
• I:N — no integrity impact to the component.
• A:H — High availability impact, consistent with authentication-driven disruption (lockouts, connection failures) against the victim host/account.

Business impact. The realistic escalation is identity compromise: an attacker who can crack or relay the captured hash can move laterally within the environment, access file shares, and potentially reach additional systems under the victim's identity. Because the technique is silent, it is well suited to phishing-lure delivery at scale against an organization's user base. If the victim is a privileged user, the blast radius extends to any resource that accepts that identity. Account lockout induced by repeated forced authentication can cause operational disruption for the affected user population.

Blast radius. Any endpoint or server where a vulnerable Foxit PDF Editor/Reader build is installed and where users open externally sourced PDFs. The affected version range is not published by any tracked source; treat all deployments as potentially affected until a vendor statement is available. Environments that permit outbound SMB (137/139/445) from user subnets to the internet or to attacker-accessible internal hosts have the largest exposure.

Patch status. Patch Confidence 0/4 — UNPATCHED. No vendor fix, no workaround, and no affected-version list are documented in the available intelligence. EPSS has not been scored by FIRST.org; no value is asserted here. CISA KEV: not listed.

Detection Guidance

Detection should focus on two surfaces: the client endpoint (unexpected outbound SMB originating from the PDF reader process) and the network (SMB authentication attempts to anomalous destinations, especially external or non-standard hosts).

Sigma Rule

title: Foxit PDF Reader Forced SMB Authentication via Crafted PDF (CVE-2026-91796)
id: 8f2c1e04-3a7b-4d19-9c6e-5b0f7a2d1e33
status: experimental
description: Detects outbound SMB connections originating from Foxit PDF Editor/Reader processes, consistent with forced authentication from a crafted PDF exploiting CVE-2026-91796.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91796
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1187
  - cve.2026.91796
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\FoxitPDFReader.exe'
      - '\FoxitPDFEditor.exe'
      - '\FoxitPDFReader.exe'
  selection_smb:
    DestinationPort:
      - 445
      - 139
  filter_local:
    DestinationIp|cidr:
      - '127.0.0.0/8'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_process and selection_smb and not filter_local
fields:
  - Image
  - DestinationIp
  - DestinationPort
  - User
falsepositives:
  - Legitimate enterprise PDF workflows referencing internal file shares (covered by filter_local)
  - Authorized document management integrations over SMB
level: high

Note on tuning: the filter_local clause suppresses expected intranet share access. In environments where internal SMB is itself untrusted or where relay is a concern, remove the RFC1918 exclusions and instead baseline known-good SMB destinations.

YARA Rule

rule CVE_2026_91796_Foxit_Forced_Auth_PDF
{
    meta:
        description = "Detects PDFs referencing remote SMB/UNC paths, a common vector for Foxit secure-reading-mode bypass leading to forced authentication (CVE-2026-91796)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91796"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $pdf_magic = { 25 50 44 46 2D }              // %PDF-
        $unc1 = "\\\\" ascii wide nocase
        $smb1 = "smb://" ascii wide nocase
        $slashes = "\\\\\\\\" ascii wide nocase

    condition:
        $pdf_magic at 0 and
        ($unc1 or $smb1 or $slashes) and
        filesize < 25MB
}

Note: this is a heuristic content match intended for hunting suspicious PDFs that reference remote UNC/SMB resources. It will produce false positives on legitimate PDFs that link to network shares; use it as a triage filter, not a verdict. YARA is applied to the document, not to the Foxit binary.

Suricata IDS Rule

alert smb any any -> any 445 (msg:"CVE-2026-91796 Possible Foxit PDF Forced SMB Authentication - NTLM Negotiate to External Host"; flow:to_server,established; content:"|FF|SMB"; offset:4; depth:4; content:"|00|"; byte_test:1,=,0x72,0,relative; pcre:"/(?i)Foxit/"; sid:202691796; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-91796, attack.t1187; classtype:attempted-recon; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91796;)

Important: Suricata cannot reliably correlate an SMB session to the originating PDF client from network metadata alone; the keyword match above is inclusive and will over-alert. The reliable network signal is SMB authentication traffic to destinations that are not known file servers — operate this rule with a whitelist of legitimate SMB peers. Treat the outbound-to-internet SMB case as high fidelity.

Elastic Detection

network where event.action == "connection_attempted" and
  process.name in ("FoxitPDFReader.exe", "FoxitPDFEditor.exe") and
  destination.port in (139, 445) and
  not cidrMatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8")

For endpoint telemetry that records authentication rather than raw connections, the alternate EQL follows — Windows Security event 4624 (Logon Type 3) or 4776 (NTLM validation) with a non-internal workstation destination and a source process of the Foxit reader:

any where event.code in ("4624", "4776") and
  winlog.event_data.LogonType == "3" and
  process.name : ("FoxitPDFReader.exe", "FoxitPDFEditor.exe")

Splunk SPL Query

Detect outbound SMB from the Foxit reader to non-RFC1918 destinations, using Sysmon network telemetry (Event ID 3):

index=sysmon EventCode=3
  Image IN ("*\\FoxitPDFReader.exe", "*\\FoxitPDFEditor.exe")
  (DestinationPort=445 OR DestinationPort=139)
  NOT (DestinationIp=10.* OR DestinationIp=172.1[6-9].* OR DestinationIp=172.2[0-9].* OR DestinationIp=172.3[0-1].* OR DestinationIp=192.168.* OR DestinationIp=127.*)
| stats count min(_time) as first_seen max(_time) as last_seen values(DestinationIp) as dests by Computer, User, Image
| where count > 0
| sort - last_seen

Corroborating query for authentication lockout/disruption (Security log), useful for detecting repeated forced attempts against a single account:

index=wineventlog (EventCode=4625 OR EventCode=4776)
  Logon_Type=3
| stats count values(Workstation_Name) as src by Target_Account_Name, Computer
| where count > 10
| sort - count

Wazuh OSSEC Rule

<group name="windows,sysmon,smb,cve-2026-91796,">
  <rule id="100796" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image">FoxitPDFReader.exe|FoxitPDFEditor.exe</field>
    <field name="win.eventdata.destinationPort">^445$|^139$</field>
    <description>CVE-2026-91796: Foxit PDF Reader/Editor initiated outbound SMB connection (possible forced authentication)</description>
    <mitre>
      <id>T1187</id>
    </mitre>
    <group>cve_2026_91796,forced_authentication,</group>
  </rule>
</group>

Tuning: rule 61603 is the Sysmon Event ID 3 (network connection) base rule in the default Wazuh ruleset; verify the SID matches your ruleset version. Add a local decoder condition or rule exclusion for known internal file servers to reduce noise.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). There is no vendor fix, no documented workaround, and no published affected-version range. The measures below are defense-in-depth controls that reduce exploitability of the vulnerability class; they do not remediate the missing permission check.

1) Immediate mitigations

• Restrict outbound SMB at the network edge and host firewall. Block egress to TCP 139 and 445 from user endpoint subnets to any destination other than authorized internal file servers. This is the single highest-value control: the vulnerability requires an outbound SMB authentication to succeed, and blocking that path neutralizes the hash-disclosure step regardless of whether any attacker reaches an internal listener.
• Enforce SMB signing and disable NTLM where operationally feasible. Require SMB signing on all servers and clients to defeat NTLM relay, and move to Kerberos-only authentication where possible. This does not stop hash capture but blocks the relay escalation path.
• User awareness for the specific lure. Because the exploit is silent once the document is opened, encourage users to treat unsolicited PDF attachments and downloads with remote-resource links as untrusted, and to report documents that cause unexpected network activity or file-server prompts.
• Application control / least privilege. Where feasible, reduce the exposure surface by ensuring the PDF reader runs with standard user rights (forced authentication under a standard user still yields that user's hash, but limits subsequent relay targets reachable with that identity).

2) Patch / upgrade steps

• No patch is available. Monitor the Foxit security advisory and release notes channels for a fix referencing CVE-2026-91796 or the secure reading mode permission check.
• When a patched build is published, prioritize deployment to endpoints that open externally sourced PDFs (email gateway users, shared-service accounts, administrative workstations).
• Validate the update by confirming secure reading mode enforces a prompt/verification for documents that trigger outbound resource access; treat the vendor's version notes as authoritative over any third-party severity claim.
• Do not apply CVSS values from third-party templates over the NVD score; use 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) as the reference.

3) Long-term hardening

• Adopt a policy of default-deny for outbound SMB. Treat SMB as an internal-only protocol and audit egress rules regularly.
• Credential hygiene: rotate passwords for any account whose hash may have been exposed; enforce strong, high-entropy passwords and unique local administrative passwords to reduce offline-cracking success.
• Monitor for lockout-driven disruption so that forced-authentication attempts are detected early rather than manifesting as an unexplained help-desk surge.
• Maintain an asset inventory of PDF client versions across the estate so that, once a patch exists, response can be scoped and measured quickly.
• Reassess secure reading mode configuration periodically: verify the setting is enabled and that the client honors it, since the CVE demonstrates the control can be bypassed when its permission verification is absent.

References

• NVD — CVE-2026-91796 Detail: https://nvd.nist.gov/vuln/detail/CVE-2026-91796
• MITRE ATT&CK — T1187 Forced Authentication: https://attack.mitre.org/techniques/T1187/
• CWE-693 — Protection Mechanism Failure: https://cwe.mitre.org/data/definitions/693.html
• FIRST — EPSS (no score currently published for this CVE): https://www.first.org/epss/
• CISA — Known Exploited Vulnerabilities Catalog (CVE-2026-91796 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor and exploit-in-the-wild evidence: None available. No public PoC, no Nuclei template, no exploit code, and no KEV listing exist for CVE-2026-91796 at the time of writing. No threat actor campaign has been attributed to this CVE in the available intelligence. Forced-authentication techniques as a class are used by both financially motivated intrusion sets and initial-access brokers, but no specific attribution is supported by the data provided for this vulnerability.