Skip to main content

HP Easy Start CVE-2026-12555

| EUVDEUVD-2026-64949 HIGH
Creation of Temporary File in Directory with Insecure Permissions (CWE-379)
2026-08-24 hp-security-alert@hp.com GHSA-9jpq-gp3p-pv2f
Privilege Escalation Apple HP
7.7
CVSS 4.0 · Vendor: hp
Share

Severity by source

Vendor (hp) PRIMARY
7.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.0 HIGH

CWE-379 is a local filesystem attack; AV:L overrides vendor AV:N as inconsistent; AC:H reflects race condition timing requirement indicated by AT:P.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hp).

CVSS VectorVendor: hp

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 24, 2026 - 17:02 EUVD
Analysis Generated
Aug 24, 2026 - 16:31 vuln.today
CVE Published
Aug 24, 2026 - 16:16 cve.org
HIGH 7.7

DescriptionCVE.org

Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.

AnalysisAI

Privilege escalation in HP Easy Start for macOS (versions prior to 2.16.7.260722) allows low-privileged local users to gain elevated system access through insecure temporary file handling, classified under CWE-379. HP has released version 2.16.7.260722 to address these vulnerabilities, as detailed in advisory HPSBPI04124. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a low-privileged local user account on a macOS system with HP Easy Start prior to version 2.16.7.260722 installed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-assigned CVSS 4.0 score is 7.7 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Update HP Easy Start to version 2.16.7.260722 or later as documented in HP security bulletin HPSBPI04124 (https://support.hp.com/in-en/document/ish_15512340-15512362-16/hpsbpi04124). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all macOS systems running HP Easy Start versions prior to 2.16.7.260722 and notify affected users of the security update requirement. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in HP

View all
CVE-2015-3113 CRITICAL POC
9.8 Jun 23

Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
CVE-2017-5638 CRITICAL POC
9.8 Mar 11

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
CVE-2017-3881 CRITICAL POC
9.8 Mar 17

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software co
CVE-2013-4810 CRITICAL POC
9.8 Sep 16

HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle

CVE-2015-8651 HIGH
8.8 Dec 28

Remote code execution in Adobe Flash Player allows network attackers to execute arbitrary code via integer overflow expl
CVE-2016-2004 CRITICAL POC
9.8 Apr 21

HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary cod
CVE-2014-2623 CRITICAL POC
10.0 Jul 18

Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown
CVE-2013-6221 CRITICAL POC
10.0 Jun 18

Directory traversal vulnerability in CommunicationServlet in HP Service Virtualization 3.x before 3.50.1, when the AutoP
CVE-2013-2367 CRITICAL POC
10.0 Jul 31

Multiple unspecified vulnerabilities in HP SiteScope 11.20 and 11.21, when SOAP is used, allow remote attackers to execu
CVE-2013-4811 CRITICAL POC
10.0 Sep 16

UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4
CVE-2013-4798 CRITICAL POC
10.0 Jul 29

Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown ve

Same weakness CWE-379 – Creation of Temporary File in Directory with Insecure Permissions

View all
CVE-2022-23950 HIGH POC
7.5
CVE-2019-25677 MEDIUM POC
6.9
CVE-2020-8831 MEDIUM POC
5.5
CVE-2026-14551 HIGH
8.8
CVE-2026-86836 HIGH
8.4
CVE-2024-9500 HIGH
7.8
CVE-2023-49797 HIGH
7.8
CVE-2023-3972 HIGH
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

CVE-2026-12555 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy