HP DesignJet T3500 CVE-2026-18243

The victim must actively navigate to and view a print job preview through the HP DesignJet T3500 embedded web interface - this user interaction (UI:A) is a hard prerequisite and cannot be bypassed passively. The attacker must be positioned on the same network segment as the printer (AV:A), limiting exploitation to users on the same LAN, WLAN, or broadcast domain. No authentication is required from the attacker to submit the malicious request (PR:N). Exploitation is further limited by the need to predict or control when a specific user will view the preview. Standard enterprise deployments where printers reside on dedicated printer VLANs accessible only to authorized workstations would significantly impede exploitation, even without patching.

The CVSS 4.0 score of 6.9 places this in the medium-severity band, and the adjacent-network constraint (AV:A) is a meaningful real-world limiter - an attacker must already hold a position on the same network segment as the printer. The high integrity impact (VI:H) is the most notable signal: for an XSS this suggests the attack can influence what the victim does within the printer interface, not merely read reflected content. Active user interaction (UI:A) is required, meaning exploitation cannot succeed without a user navigating to and viewing a specific print job preview, further narrowing the window. No EPSS data was provided so exploitation probability cannot be quantified; the absence from CISA KEV and absence of known POC collectively indicate this is not actively exploited or currently targeted. The combination of no KEV, no POC, adjacent-only vector, and required user interaction places this at low immediate operational urgency for most organizations - but environments with untrusted users co-located on printer subnets (shared office Wi-Fi, education, co-working spaces) face elevated realistic risk.

An attacker on the same office network segment as the HP DesignJet T3500 submits a print job with an XSS payload embedded in a job name, document title, or other user-visible metadata field. When a print administrator or office user opens the printer's web interface and views the print job preview, the injected script executes in their browser - potentially harvesting session tokens, forging print cancellation or configuration actions, or redirecting the victim to a credential-harvesting page. No public proof-of-concept code has been identified at time of analysis.