HP ThinPro CVE-2026-84900

Requires LOCAL PHYSICAL ACCESS to an HP ThinPro device (CVSS AV:P) - there is no remote or network attack path. Exploitation leverages improper validation of an integrity check value (CWE-354), meaning the attacker manipulates data/firmware/images that the device fails to properly verify; low attack complexity (AC:L) and no authentication (PR:N) or user interaction (UI:N) are needed once physical access exists. LIMITING FACTORS: the mandatory physical-access requirement severely narrows the realistic threat to scenarios with unattended or shared endpoints (kiosks, lobbies, unsecured VDI terminals); affected systems are limited to HP ThinPro versions prior to 8.1 SP10 (8.1 branch) and prior to 9 SP3 (9 branch). No availability impact (VA:N).

Real-world risk is MODERATE-but-constrained. The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N) is the dominant signal: exploitation requires PHYSICAL access to the device, which is the single largest limiting factor and the reason the base score sits at 6.8 despite high confidentiality and integrity impact (VC:H/VI:H, VA:N). No EPSS score, KEV listing, or POC was provided in the input - there is no public exploit identified at time of analysis and no evidence of active exploitation, so this is not a drop-everything priority. Signals are internally consistent (physical vector + high C/I + no availability impact is coherent for a thin-client integrity flaw), but note a CLASSIFICATION TENSION: the input Tag says 'Information Disclosure' while CWE-354 (Improper Validation of Integrity Check Value) and the vector's VI:H point to an integrity/tampering issue, not purely disclosure - treat the one-word tag as incomplete rather than authoritative. Also note the HP advisory text is a generic boilerplate roll-up ('could potentially contain security vulnerabilities') and does not describe the specific flaw, so technical specifics are inferred from CWE and the CVSS vector, not confirmed by a detailed vendor writeup.

An attacker with hands-on physical access to an HP ThinPro thin client (e.g., an unattended kiosk, lobby, or shared VDI endpoint) exploits weak or missing integrity validation (CWE-354) to tamper with or extract protected data/firmware that should have failed an integrity check. Because the CVSS vector is AV:P/AC:L/PR:N, no credentials and only low attacker effort are needed once physical access is obtained, but remote or network exploitation is not possible. No public exploit identified at time of analysis.