How to fix or mitigate CVE-2026-7539?

24 hours: Inventory all systems with HP Docking Stations and document affected WMI Provider installer versions. 7 days: Contact HP for patch availability and timeline per advisory hpsbhf04129; restrict local user privileges and monitor installation processes. 30 days: Deploy vendor patches to all affected systems immediately upon release; verify successful remediation across the fleet.

Hp Dock Accessory CVE-2026-7539

Q: What is the CVSS score of CVE-2026-7539?

CVE-2026-7539 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

Q: Which versions of Hp Dock Accessory are affected by CVE-2026-7539?

A high-severity local privilege escalation vulnerability (CVE-2026-7539) affects the HP Accessory WMI Provider installer bundled with certain HP Docking Stations, allowing low-privileged users to…. A patch is available.

EUVD-2026-39057 HIGH

Creation of Temporary File in Directory with Insecure Permissions (CWE-379)

2026-06-24 hp

GHSA-fcm3-pjp2-xx9r

Privilege Escalation RCE HP Hp Dock Accessory Hp Inc

7.3

CVSS 4.0 · Vendor: hp

Severity by source

Vendor (hp) PRIMARY

7.3 HIGH

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (hp) · only source for this CVE.

CVSS VectorVendor: hp

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 24, 2026 - 22:03 EUVD

Analysis Generated

Jun 24, 2026 - 20:51 vuln.today

DescriptionCVE.org

A potential security vulnerability has been identified in the HP Accessory WMI Provider installer for some HP Docking Stations, which might allow escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.

AnalysisAI

Local privilege escalation and arbitrary code execution in the HP Accessory WMI Provider installer bundled with certain HP Docking Stations allows a low-privileged local user to gain elevated (likely SYSTEM) execution. The root cause is insecure temporary-file/directory permissions used during installation (CWE-379), which an attacker can abuse to introduce or replace executable content that a privileged installer process runs. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; HP has published advisory hpsbhf04129 and is releasing software updates.