Which versions of HP Web Jetadmin are affected by CVE-2026-12553?

HP Web Jetadmin vulnerability (CVE-2026-12553, CVSS 8.9) allows unauthenticated remote attackers to read and write arbitrary files on affected systems, directly exposing managed device credentials…. A patch is available.

How to fix or mitigate CVE-2026-12553?

Within 24 hours, immediately identify and catalog all HP Web Jetadmin deployments and implement network-level access restrictions to limit remote connectivity to WJA interfaces; document baseline system configurations and current access permissions for change detection. Within 7 days, implement enhanced logging and monitoring across all WJA systems to detect file access anomalies, deploy available IDS/IPS signatures for exploit detection, and review historical access logs for indicators of compromise or unauthorized file operations. Within 30 days, establish continuous monitoring of HP vendor security advisories for patch releases, conduct threat assessment of WJA's position in network architecture, evaluate feasibility of temporarily disabling non-critical instances, and assess alternative device management platform solutions to reduce long-term risk exposure.

HP Web Jetadmin CVE-2026-12553

Q: What is the CVSS score of CVE-2026-12553?

CVE-2026-12553 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-60324 HIGH

Out-of-bounds Write (CWE-787)

2026-08-17 hp

GHSA-29p9-9rf3-jx84

Memory Corruption Buffer Overflow HP Web Jetadmin

8.9

CVSS 4.0 · Vendor: hp

Severity by source

Vendor (hp) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network access (AV:N/PR:N), low complexity, no user interaction, full triad impact; scope unchanged as subsequent systems are not affected per CVSS 4.0 SC:N/SI:N/SA:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hp).

CVSS VectorVendor: hp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 17, 2026 - 19:18 EUVD

Analysis Generated

Aug 17, 2026 - 19:07 vuln.today

CVE Published

Aug 17, 2026 - 18:13 cve.org

HIGH 8.9

DescriptionCVE.org

HP has identified a potential vulnerability in HP Web Jetadmin (WJA) that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism.

AnalysisAI

Arbitrary file read and write in HP Web Jetadmin (WJA) is achievable by unauthenticated remote actors via a DLL hijacking mechanism, carrying a CVSS 4.0 score of 8.9. The flaw exposes full confidentiality, integrity, and availability of the WJA host - an attacker can exfiltrate sensitive configuration and credential files or overwrite system files to achieve persistent access. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	No authentication is required - the CVSS 4.0 vector specifies PR:N and UI:N, confirming unauthenticated exploitation over the network with no user interaction. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 base score of 8.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H reflects a severe, low-complexity, unauthenticated network-exploitable flaw with full triad impact - this is a genuinely high-priority finding, not a high-score-but-low-risk anomaly. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Consult the HP advisory at https://support.hp.com/us-en/document/ish_15260929-15260951-16/hpsbpi04130 for the authoritative patch version; no exact fixed release version was available in the provided data, so a specific upgrade target cannot be stated here - the input does not confirm a patched version number. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, immediately identify and catalog all HP Web Jetadmin deployments and implement network-level access restrictions to limit remote connectivity to WJA interfaces; document baseline system configurations and current access permissions for change detection. …

Threat intelligence, references, and detailed analysis are available after sign-in.