EUVD-2026-39057
GHSA-fcm3-pjp2-xx9r
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Temp file permissions
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 24, 2026
Local privilege escalation and arbitrary code execution in the HP Accessory WMI Provider installer bundled with certain HP Docking Stations allows a low-privileged local user to gain elevated (likely SYSTEM) execution. The root cause is insecure temporary-file/directory permissions used during installation (CWE-379), which an attacker can abuse to introduce or replace executable content that a privileged installer process runs. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; HP has published advisory hpsbhf04129 and is releasing software updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Hp Dock Accessory gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from Vendor (hp) · only source for this CVE.
CVSS VectorVendor: hp
Lifecycle Timeline
1DescriptionCVE.org
A potential security vulnerability has been identified in the HP Accessory WMI Provider installer for some HP Docking Stations, which might allow escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.
Executive ViewAI
A high-severity local privilege escalation vulnerability (CVE-2026-7539) affects the HP Accessory WMI Provider installer bundled with certain HP Docking Stations, allowing low-privileged users to execute arbitrary code with SYSTEM-level privileges. No public exploit has been identified at time of analysis, but the vulnerability poses significant insider threat and privilege escalation risk for organizations deploying affected docking stations. Vendor patches are expected per HP advisory hpsbhf04129.
24 hours: Inventory all systems with HP Docking Stations and document affected WMI Provider installer versions. 7 days: Contact HP for patch availability and timeline per advisory hpsbhf04129; restrict local user privileges and monitor installation processes. 30 days: Deploy vendor patches to all affected systems immediately upon release; verify successful remediation across the fleet.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict execution and write permissions on installer temporary directories, (2) Apply principle of least privilege to local user accounts, (3) Monitor WMI Provider and docking station installer processes in SIEM/EDR for suspicious activity, (4) Deploy code integrity and application whitelisting policies on affected systems. Apply vendor patch immediately upon availability per HP advisory hpsbhf04129.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB