Which versions of HP Easy Start are affected by CVE-2026-12554?

HP Easy Start for macOS versions prior to 2.16.7.260722 contain a privilege escalation flaw (CVE-2026-12554, CVSS 8.5) allowing local users to gain administrative access to managed devices.. A patch is available.

How to fix or mitigate CVE-2026-12554?

Within 24 hours, inventory all macOS endpoints and identify those running HP Easy Start versions prior to 2.16.7.260722. Within 7 days, deploy HP Easy Start version 2.16.7.260722 or later through your standard patch management process, prioritizing systems with multiple users or sensitive data access. Within 30 days, verify complete deployment across all affected endpoints, confirm the vulnerable versions are no longer present, and remove any legacy versions from software distribution repositories.

HP Easy Start CVE-2026-12554

Q: What is the CVSS score of CVE-2026-12554?

CVE-2026-12554 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-64948 HIGH

Use of Unmaintained Third Party Components (CWE-1104)

2026-08-24 hp-security-alert@hp.com

GHSA-7wvw-8j5r-xv28

Privilege Escalation Apple HP

8.5

CVSS 4.0 · Vendor: hp

Severity by source

Vendor (hp) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local attack vector and low privileges required for privilege escalation; unchanged scope as no subsequent system impact is indicated.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hp).

CVSS VectorVendor: hp

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 24, 2026 - 17:02 EUVD

Analysis Generated

Aug 24, 2026 - 16:31 vuln.today

CVE Published

Aug 24, 2026 - 16:16 cve.org

HIGH 8.5

DescriptionCVE.org

Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.

AnalysisAI

Privilege escalation vulnerabilities in HP Easy Start for macOS, versions prior to 2.16.7.260722, allow a local low-privileged user to gain elevated system access. Classified under CWE-1104 (Use of Unmaintained Third-Party Components), the root cause likely involves outdated bundled libraries within the printer setup utility. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires local interactive access to a macOS system with HP Easy Start installed and a low-privilege (non-administrator) user account (PR:L, AV:L per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 8.5 reflects high-impact local privilege escalation, but the local attack vector (AV:L) and low-privilege requirement (PR:L) substantially constrain real-world exploitability - an attacker must already have an interactive session or code execution on the target macOS host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary fix is to update HP Easy Start to version 2.16.7.260722 or later, as documented in HP security bulletin HPSBPI04124 at https://support.hp.com/in-en/document/ish_15512340-15512362-16/hpsbpi04124. … Detailed patch versions, workarounds, and compensating controls in full report.